24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ser.Jalapeno.Generic Sample 2d80a9e5f2d7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2d80a9e5f2d7…. Malware family: Ser.Jalapeno.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963","keywords":["Malicious","Ser.Jalapeno.Generic","malware analysis","sandbox report","threat intelligence","2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963"],"about":{"@type":"SoftwareApplication","name":"2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ser.Jalapeno.Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T40a,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002420.00000000.139567.6EE61000.00000020.mdmp, 00000000-00002420.00000001.141486.6ED81000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp")26:T6a8,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002420.00000001.141486.6EE75000.00000002.mdmp, 00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002420.00000001.141486.6EE75000.00000002.mdmp, 00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002420.00000003.143942.07C50000.00000004.mdmp, 00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp")27:T1a0d,Found reference to "do9RPta2e7AesM" (Indicator: "Aes"; File: "2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963.bin") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp")28:T99b,"" (Indicator: "enumchildwindows"; Source: "00000000-00002420.00000000.139567.03180000.00000004.mdmp, 00000000-00002420.00000001.141486.03180000.00000004.mdmp, 00000000-00002420.00000002.143408.03180000.00000004.mdmp, 00000000-00002420.00000003.143942.03180000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp")2d:T22d4,".pm" Heuristic match: "y|.it" Heuristic match: "exu8wctti8uytjhbpqv2wu8cbemck.my"44:T1629,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002420.00000000.139567.03180000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:c:\2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963.bin.exe.configc:\2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963.bin.exe.configswitch.system.globalization.noasynccurrentcultureswitch.system.globalization.enforcejapaneseerayearrangesswitch.system.globalization.formatjapanesefirstyearasanumberswitch.system.globalization.enforcelegacyjapanesedateparsingswitch.system.threading.throwexceptionifdisposedcancellationtokensourceswitch.system.diagnostics.eventsource.preserveeventlistnerobjectidentityswitch.system.io.uselegacypathhandlingswitch.system.io.blocklongpathsswitch.system.security.cryptography.donotaddrofcspparentwindowhandleswitch.system.security.claimsidentity.setactorasreferencewhencopyingclaimsidentityswitch.system.diagnostics.ignoreportablepdbsinstacktracesswitch.system.runtime.serialization.usenewmaxarraysizeswitch.system.threading.uselegacyexecutioncontextbehavioruponundofailureswitch.system.security.cryptography.uselegacyfipsthrowswitch.system.runtime.interopservices.donotmarshaloutbyrefsafearrayoninvokeswitch.system.threading.usenetcoretimertestswitch.localappcontext.disablecaching.netframeworkversionprofile.netframeworkversion=v4.6versionv4.6.netcorewindowsphonewindowsphoneappsoftware\microsoft\.netframework\appcontext" - Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002420.00000000.139567.6EE61000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002420.00000001.141486.03180000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00002420.00000001.141486.08330000.00000004.mdmp") Found URL "http://ns.adobe.com/xap/1.0/xmpid8bimiplogscrdescimgdesciccp/www.w3.org/1999/02/22-r/xap/1.0/ns.adobe.com/xap/1.0/rig1.0/bj/photoshophttp://ns.a.adobe.com/http://ns.adobe.com/xahttp://ns..0/stype/version" - Source: "00000000-00002420.00000001.141486.08330000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00002420.00000001.141486.6ED81000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00002420.00000001.141486.6ED81000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00002420.00000001.141486.6ED81000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002420.00000002.143408.03180000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json02/13" - Source: "00000000-00002420.00000002.143408.07D60000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,002/13" - Source: "00000000-00002420.00000002.143408.07D60000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00002420.00000002.143408.08330000.00000004.mdmp") Found URL "http://ns.adobe.com/xap/1.0/xmpid8bimiplogscrdescimgdesciccp/www.w3.org/1999/02/22-r/xap/1.0/ns.adobe.com/xap/1.0/rig1.0/bj/photoshophttp://ns.a.adobe.com/http://ns.adobe.com/xahttp://ns..0/stype/version" - Source: "00000000-00002420.00000002.143408.08330000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002420.00000003.143942.03180000.00000004.mdmp") Found URL "http://ns.adobe.com/xap/1.0/xmpid8bimiplogs" - Source: "00000000-00002420.00000003.143942.0837C000.00000004.mdmp")45:T9e4,"" (Indicator: "GetDC"; Source: "00000000-00002420.00000000.139567.03180000.00000004.mdmp, 00000000-00002420.00000001.141486.03180000.00000004.mdmp, 00000000-00002420.00000002.143408.03180000.00000004.mdmp, 00000000-00002420.00000003.143942.03180000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002420.00000000.139567.03180000.00000004.mdmp, 00000000-00002420.00000001.141486.03180000.00000004.mdmp, 00000000-00002420.00000002.143408.03180000.00000004.mdmp, 00000000-00002420.00000003.143942.03180000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002420.00000000.139567.03180000.00000004.mdmp, 00000000-00002420.00000001.141486.03180000.00000004.mdmp, 00000000-00002420.00000002.143408.03180000.00000004.mdmp, 00000000-00002420.00000003.143942.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002420.00000000.139567.03180000.00000004.mdmp, 00000000-00002420.00000001.141486.03180000.00000004.mdmp, 00000000-00002420.00000002.143408.03180000.00000004.mdmp, 00000000-00002420.00000003.143942.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002420.00000000.139567.03180000.00000004.mdmp, 00000000-00002420.00000001.141486.03180000.00000004.mdmp, 00000000-00002420.00000002.143408.03180000.00000004.mdmp, 00000000-00002420.00000003.143942.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002420.00000000.139567.03180000.00000004.mdmp, 00000000-00002420.00000001.141486.03180000.00000004.mdmp, 00000000-00002420.00000002.143408.03180000.00000004.mdmp, 00000000-00002420.00000003.143942.03180000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002420.00000000.139567.03180000.00000004.mdmp, 00000000-00002420.00000001.141486.03180000.00000004.mdmp, 00000000-00002420.00000002.143408.03180000.00000004.mdmp, 00000000-00002420.00000003.143942.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002420.00000000.139567.03180000.00000004.mdmp, 00000000-00002420.00000001.141486.03180000.00000004.mdmp, 00000000-00002420.00000002.143408.03180000.00000004.mdmp, 00000000-00002420.00000003.143942.03180000.00000004.mdmp")48:T4c6,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002420.00000001.141486.6EE75000.00000002.mdmp, 00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002420.00000001.141486.6EE75000.00000002.mdmp, 00000000-00002420.00000003.143942.07C50000.00000004.mdmp, 00000000-00002420.00000003.143942.09D30000.00000004.mdmp, 00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002420.00000001.141486.6EE75000.00000002.mdmp, 00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002420.00000001.141486.6EE75000.00000002.mdmp, 00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002420.00000003.143942.09D30000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00002420.00000003.143942.09D30000.00000004.mdmp")49:T9ea,Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002420.00000000.139567.6EE61000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002420.00000000.139567.6EE61000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002420.00000000.139567.6EE61000.00000020.mdmp, 00000000-00002420.00000001.141486.6ED81000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002420.00000000.139567.6EE61000.00000020.mdmp, 00000000-00002420.00000001.141486.6ED81000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002420.00000000.139567.6EE61000.00000020.mdmp, 00000000-00002420.00000001.141486.6ED81000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002420.00000000.139567.6EE61000.00000020.mdmp, 00000000-00002420.00000001.141486.6ED81000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002420.00000001.141486.6ED81000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002420.00000001.141486.6ED81000.00000020.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002420.00000001.141486.6EE75000.00000002.mdmp, 00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002420.00000001.141486.6EE75000.00000002.mdmp, 00000000-00002420.00000003.143942.07C50000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002420.00000001.141486.6EE75000.00000002.mdmp, 00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002420.00000001.141486.6EE75000.00000002.mdmp, 00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00002420.00000003.143942.07C50000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp")4a:T465,Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002420.00000000.139567.05390000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002420.00000002.143408.09D10000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002420.00000002.143408.09D20000.00000004.mdmp, 00000000-00002420.00000003.143942.09D20000.00000004.mdmp")4b:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002420.00000003.143942.6EE11000.00000002.mdmp")4c:Tab6,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002420.00000000.139567.03180000.00000004.mdmp, 00000000-00002420.00000001.141486.03180000.00000004.mdmp, 00000000-00002420.00000002.143408.03180000.00000004.mdmp, 00000000-00002420.00000003.143942.03180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"698ee7fa4626c2f7fe08e9af"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"698ee7fa4626c2f7fe08e9af"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002420.00000000.139567.03180000.00000004.mdmp\n 00000000-00002420.00000001.141486.03180000.00000004.mdmp\n 00000000-00002420.00000002.143408.03180000.00000004.mdmp\n 00000000-00002420.00000003.143942.03180000.00000004.mdmp\n Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002420.00000000.139567.05390000.00000004.mdmp\n Observed string: \"C:\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002420.00000000.139567.05390000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"698ee7fa4626c2f7fe08e9af"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963.bin\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963.bin\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"PowerPoint.exe\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"PowerPoint.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"698ee7fa4626c2f7fe08e9af"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963.bin has big resource with name: \"BargainingPlat.temona.json\" size: \"484556\" and abnormal entropy:\"7.678857033094232\"\n PowerPoint.exe has big resource with name: \"BargainingPlat.temona.json\" size: \"484556\" and abnormal entropy:\"7.678857033094232\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"698ee7fa4626c2f7fe08e9af"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002420.00000002.143408.099D0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002420.00000003.143942.07C50000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002420.00000003.143942.09D30000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006384.00000001.143934.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"698ee7fa4626c2f7fe08e9af"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002420.00000000.139567.05390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"698ee7fa4626c2f7fe08e9af"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00002420.00000003.143942.6EE11000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00002420.00000003.143942.6EE11000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002420.00000003.143942.6EE11000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00002420.00000003.143942.6EE11000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00002420.00000003.143942.6EE11000.00000002.mdmp\"\n Found registry query API: \"RegNotifyChangeKeyValue\" in \"00000000-00002420.00000003.143942.6EE11000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"698ee7fa4626c2f7fe08e9af"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00002420.00000003.143942.07C50000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00002420.00000003.143942.09D30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"698ee7fa4626c2f7fe08e9af"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"