21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T504,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 2d9f8c6e0083… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2d9f8c6e0083…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/26 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b"],"about":{"@type":"SoftwareApplication","name":"2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":5,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T53a,"" (Indicator: "password"; Source: "00000000-00000628.00000001.187355.0131B000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00000628.00000001.187355.092C0000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00000628.00000001.187355.092C0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00000628.00000001.187355.09300000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00000628.00000001.187355.09300000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00000628.00000001.187355.09320000.00000004.mdmp")2c:T6fe,"9iqmgvw,czcthawte," - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/+pkcs2.5.29.10system.management.automationmicrosoft.powershell.consolehost=verisign," - Source: "00000000-00000628.00000000.186903.0137F000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00000628.00000000.186903.037F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000628.00000000.186903.037F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000628.00000000.186903.037F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysb0@0geotrust" - Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00000628.00000000.186903.6F3C1000.00000020.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000628.00000001.187355.0131B000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000628.00000001.187355.0131B000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000628.00000001.187355.0137F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000628.00000001.187355.0137F000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000628.00000001.187355.0137F000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000628.00000001.187355.0137F000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000628.00000001.187355.0137F000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000628.00000001.187355.0137F000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/+pkcs2.5.29.10system.management.automationmicrosoft.powershell.consolehost=verisign," - Source: "00000000-00000628.00000001.187355.0138E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysb0@0geotrust" - Source: "00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000628.00000001.187355.07D1B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00000628.00000001.187355.07D31000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00000628.00000001.187355.09350000.00000004.mdmp") Found URL "https://connect.microsoft.com/powershell/feedback/details/421837" - Source: "00000000-00000628.00000001.187355.09350000.00000004.mdmp") Found URL "http://pesterbdd.com/images/pester.png" - Source: "00000000-00000628.00000001.187355.09350000.00000004.mdmp") Found URL "https://github.com/pester/pester" - Source: "00000000-00000628.00000001.187355.09350000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0.html" - Source: "00000000-00000628.00000001.187355.09350000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0wrapnonexceptionthrowslistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlist/cer[j<" - Source: "00000000-00000628.00000001.187355.09350000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!u" - Source: "00000000-00000628.00000001.187355.09350000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00000628.00000001.187355.09350000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt07" - Source: "00000000-00000628.00000001.187355.093B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000628.00000001.187355.093B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010nqrl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" - Source: "00000000-00000628.00000001.187355.093B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt06" - Source: "00000000-00000628.00000001.187355.093BE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000628.00000001.187355.093BE000.00000004.mdmp") Found URL "http://crl.microsoft.co" - Source: "00000000-00000628.00000001.187355.093BE000.00000004.mdmp") Found URL "http://w4u>" - Source: "00000000-00000628.00000001.187355.093BE000.00000004.mdmp")39:T565,Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\2d9f8c6e00839f7c513c080deb360c141e" (Indicator: "add-mppreference"; Source: "00000000-00004552-00000C46-14030654088"), Found reference string "Add-MpPreference -ExclusionPath "C:\2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe"" (Indicator: "add-mppreference"; File: "powershell.exe"), Found reference string ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe"" (Indicator: "add-mppreference"; Source: "00000000-00000628.00000000.186903.012A0000.00000004.mdmp 00000000-00000628.00000001.187355.012A0000.00000004.mdmp"), Found reference string "Add-MpPreference -ExclusionPath C:\2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe" (Indicator: "add-mppreference"; Source: "00000000-00000628.00000000.186903.05670000.00000004.mdmp"), Found reference string "HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe" (Indicator: "add-mppreference"; Source: "00000000-00000628.00000001.187355.0131B000.00000004.mdmp 00000000-00000628.00000001.187355.09350000.00000004.mdmp")3a:T8f6,"] [-EncodedCommand ]" (Indicator: "base64"; Source: "00000000-00000628.00000000.186903.05670000.00000004.mdmp") Found string "$hasherType = "System.Security.Cryptography.${Algorithm}CryptoServiceProvider" -as [Type]" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp") Found string "$algorithmType = "System.Security.Cryptography.${Algorithm}" -as [Type]" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp, 00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found string "[System.Security.Cryptography.HashAlgorithm]" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000628.00000000.186903.07C70000.00000004.mdmp, 00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000628.00000001.187355.07C70000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000628.00000001.187355.09270000.00000004.mdmp, 00000000-00000628.00000001.187355.09290000.00000004.mdmp, 00000000-00000628.00000001.187355.092C0000.00000004.mdmp, 00000000-00000628.00000001.187355.09300000.00000004.mdmp, 00000000-00000628.00000001.187355.09320000.00000004.mdmp, 00000000-00000628.00000001.187355.09340000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000628.00000001.187355.09270000.00000004.mdmp, 00000000-00000628.00000001.187355.09290000.00000004.mdmp, 00000000-00000628.00000001.187355.092C0000.00000004.mdmp, 00000000-00000628.00000001.187355.09300000.00000004.mdmp, 00000000-00000628.00000001.187355.09320000.00000004.mdmp, 00000000-00000628.00000001.187355.09340000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00000628.00000001.187355.09290000.00000004.mdmp")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[{"name":"StartupProfileData-NonInteractive","sha256":"6de5d3e3584688ff8a69f6b20b5d66b1d01f6475ddacd885759b6fe42328deb2","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"verdict":"undetected"},{"name":"2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe.log","sha256":"e44d9a2ed9c1a63c162a13d3e1906145766bb048baa3c87c17f15ddf00ce4982","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"verdict":"undetected"},{"name":"powershell.exe.log","sha256":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe.log","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ehmopuit.x4c.ps1","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_gwuqxuc2.rad.psm1","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"SM0:628:168:WilStaging_02","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"Local\\SM0:628:64:WilError_01","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:628:64:WilError_01","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"Local\\SM0:4552:64:WilError_01","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"SM0:4552:168:WilStaging_02","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:628:168:WilStaging_02","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:628:64:WilError_01","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:628:168:WilStaging_02","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4552:168:WilStaging_02","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4552:168:WilStaging_02","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"Local\\SM0:4552:168:WilStaging_02","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"SM0:4552:64:WilError_01","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"Local\\SM0:628:168:WilStaging_02","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4552:64:WilError_01","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"SM0:628:64:WilError_01","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4552:64:WilError_01","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["System.Data.dll","winnsi.dll","KernelBase.dll","comctl32.dll","windows.storage.dll","aepic.dll","sspicli.dll","Windows.StateRepositoryPS.dll","IPHLPAPI.DLL","ntmarta.dll","powrprof.dll","propsys.dll","crypt32.dll","AppxSip.dll","wmidcom.dll","DWrite.dll","vcruntime140_clr0400.dll","System.Configuration.ni.dll","ucrtbase.dll","miutils.dll","sppc.dll","SHCore.dll","Microsoft.VisualBasic.dll","cryptnet.dll","Microsoft.PowerShell.Commands.Management.dll","WindowsCodecs.dll","wshext.dll","dwmapi.dll","VxSSL32.dll","gdi32full.dll","ucrtbase_clr0400.dll","wintrust.dll","ws2_32.dll","25672xxN.dll","msvcp_win.dll","dpapi.dll","clr.dll","System.Windows.Forms.dll","System.Drawing.dll","shell32.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","rsaenh.dll","System.ni.dll","pwrshsip.dll","Microsoft.Management.Infrastructure.ni.dll","clbcatq.dll","System.Management.dll","System.Numerics.dll","amsi.dll","iertutil.dll","coml2.dll","apphelp.dll","Microsoft.BitLocker.Structures.dll","kernel32.dll","mi.dll","psapi.dll","clrjit.dll","gdi32.dll","mscoreei.dll","nsi.dll","shlwapi.dll","imagehlp.dll","System.Core.ni.dll","user32.dll","MpClient.dll","kernel.appcore.dll","System.Management.Automation.dll","msisip.dll","Microsoft.PowerShell.Security.dll","sechost.dll","combase.dll","edputil.dll","xmllite.dll","ntdll.dll","Microsoft.AppV.AppVClientPowerShell.dll","cldapi.dll","msvcrt.dll","MpOAV.dll","advapi32.dll","bcrypt.dll","profapi.dll","atl.dll","urlmon.dll","cfgmgr32.dll","wbemprox.dll","gpapi.dll","mscoree.dll","Microsoft.PowerShell.Commands.Utility.dll","bcryptprimitives.dll","wbemsvc.dll","userenv.dll","cryptbase.dll","version.dll","mscorlib.ni.dll","wow64cpu.dll","wbemcomn.dll","uxtheme.dll","OneCoreUAPCommonProxyStub.dll","wldp.dll","imm32.dll","System.Transactions.dll","rpcrt4.dll","System.Xml.ni.dll","fastprox.dll","normaliz.dll","GdiPlus.dll","slc.dll","wininet.dll","msctf.dll","wow64.dll","System.DirectoryServices.dll","Microsoft.Management.Infrastructure.Native.dll","wow64win.dll","Accessibility.dll","Microsoft.PowerShell.ConsoleHost.dll","Microsoft.AppV.AppvClientComConsumer.dll","ole32.dll","msIso.dll","secur32.dll","oleaut32.dll","win32u.dll","fltLib.dll","cryptsp.dll","OpcServices.dll","msasn1.dll","System.Configuration.Install.dll"],"processes":[{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe","normalized_path":"C:\\2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe","pid":4552,"ppid":0,"sha256":"2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b","uid":"00000000-00004552"},{"command_line":"Add-MpPreference -ExclusionPath \"C:\\2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe\"","name":"powershell.exe","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004552","pid":628,"ppid":4552,"sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","uid":"00000000-00000628"},{"command_line":"","name":"2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe","normalized_path":"C:\\2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe","parent_uid":"00000000-00004552","pid":2748,"ppid":4552,"sha256":"2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b","uid":"00000000-00002748"},{"command_line":"-u -p 2748 -s 172","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002748","pid":388,"ppid":2748,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00000388"},{"command_line":"-u -p 2748 -s 172","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002748","pid":1160,"ppid":2748,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00001160"},{"command_line":"-pss -s 440 -p 2748 -ip 2748","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":924,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00000924"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process","Extracted Files","Sample Crashed"],"sandbox_reports":[{"analysis_start_time":"2026-05-22T05:58:20+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"6a0ff07b00d126b29804de04","indicators_count":{"informative":211,"malicious":5,"suspicious":37},"is_in_unified_schema":true,"malware_family":"Trojan.MSIL_Heur","state":"SUCCESS","submit_name":"2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin","tags":["Multi-Process","Extracted Files","Sample Crashed"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":3,"files_deleted_count":0,"files_written_count":9,"http_requests_count":0,"imported_dlls_count":126,"injected_processes_count":0,"mutex_created_count":21,"process_count":6,"registry_keys_created_count":4,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"script_calls_count":0,"spawned_processes_count":6}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Win/malicious_confidence_100%"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_-10","verdict":"malicious"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"a variant of MSIL/Kryptik.AQGB trojan","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sentinelone":{"data_source":"MetaDefender","name":"SentinelOne","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malicious","verdict":"malicious"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Troj/Krypt-AQM","verdict":"malicious"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.MSIL_Heur.A","verdict":"malicious"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Found a string that may be used as part of an injection method"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"details_count":3,"name":"Fingerprint","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"details":[{"detail":"Marks file for deletion"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"details_count":3,"name":"Evasive","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Impair Defenses"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate available system drives (PowerShell command string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"Local Storage Discovery"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Reconnaissance","technique":"Gather Victim Network Information"},{"attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Internal Proxy"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"informative","value":"Contains ability to clear Powershell session command history (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Clear Command History"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Remote Services"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands from session history (Powershell command string)"},{"type":"informative","value":"Able to write/modify file content (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands (Powershell command string)"},{"type":"informative","value":"Contains ability to receive remote commands (Powershell command string)"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Execution","technique":"PowerShell"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Able to obtain instances of WMI classes using PowerShell"},{"type":"informative","value":"Contains ability to call WMI method (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Execution","technique":"Scheduled Task/Job"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to clear content (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1036.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/003","identifiers":[{"type":"informative","value":"Contains ability to rename items (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Rename Legitimate Utilities"},{"attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Mutual Exclusion"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1546.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/003","identifiers":[{"type":"informative","value":"Contains ability to create/update instances of WMI classes (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Management Instrumentation Event Subscription"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Hollowing"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1654","attack_id_wiki":"https://attack.mitre.org/techniques/T1654","identifiers":[{"type":"informative","value":"Able to retrieve security-related event logs (PowerShell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"Log Enumeration"},{"attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive via Library"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Checks"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Encrypted/Encoded File"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1021.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/006","identifiers":[{"type":"informative","value":"Contains reference to remote powershell session activity (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Windows Remote Management"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move items (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Able to access control system service controller"},{"type":"informative","value":"Contains ability to start services (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Execution","technique":"Command and Scripting Interpreter"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/techniques/T1197","identifiers":[{"type":"informative","value":"Contains reference to background jobs (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Persistence","technique":"BITS Jobs"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Contains ability to retrieve credential objects (Powershell command string)"},{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to copy items (Powershell command string)"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Manipulation"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"},{"type":"informative","value":"Contains ability to terminate services/features (Powershell command string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Persistence","technique":"Transport Agent"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Able to retrieve browser cookies using SQL"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal Web Session Cookie"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to query the machine version"}],"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"}],"rule_matches":{},"sandbox_signatures":[{"category":"Installation/Persistence","description":"$22","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00000628-8349-121-011EE0D0\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00000628-8349-122-011EE0B0\n GetModuleHandleW@KERNEL32.DLL at 00000000-00000628-8349-193-011ED1C6\n GetModuleHandleW@KERNEL32.DLL at 00000000-00000628-8349-305-011E9754\n GetModuleHandleW@KERNEL32.DLL at 00000000-00000628-8349-313-011E9DC0","id":"stream-121","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Process \"C:\\2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.bin.exe\" spawned likely due to injection","id":"target-413","level":"suspicious","mitre_attack_id":"T1055","name":"Spawned processes are likely due to an injection","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"\" (Source: \"00000000-00000628.00000000.186903.05670000.00000004.mdmp\")","id":"string-940","level":"informative","mitre_attack_id":"T1021","name":"Able to modify Remote Configuration","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp\"","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$2d","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"General","description":"Found string - \\\\.\\pipe\\PSHost.134239031456705393.628.DefaultAppDomain.powershell","id":"string-146","level":"informative","mitre_attack_id":"T1559","name":"Found named pipe like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2e","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp, 00000000-00000628.00000000.186903.6F3D5000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp, 00000000-00000628.00000000.186903.6F3D5000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp, 00000000-00000628.00000000.186903.6F3D5000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp, 00000000-00000628.00000000.186903.6F3D5000.00000002.mdmp\")","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00004552-00000C2B-1910798527\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00004552-00000C2B-1910798550\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00000628-00000C2B-1914049118\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00000628-00000C2B-1914049150\")","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"General","description":"WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00000628-8349-133-011E995D\n Sleep@KERNEL32.DLL at 00000000-00000628-8349-179-011E9700","id":"stream-103","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay the execution of current thread","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"Get-PSDrive\" (Indicator: \"Get-PSDrive\"; Source: \"00000000-00000628.00000000.186903.05670000.00000004.mdmp\")","id":"string-997","level":"informative","mitre_attack_id":"T1680","name":"Able to enumerate available system drives (PowerShell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00000628-8349-194-011EC4B6","id":"stream-89","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files inside a directory","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2f","id":"string-396","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/modify Windows services (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp, 00000000-00000628.00000000.186903.6F3D5000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00000628.00000000.186903.05670000.00000004.mdmp\")","id":"string-378","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move items (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00000628.00000000.186903.07C70000.00000004.mdmp\n 00000000-00000628.00000001.187355.07C70000.00000004.mdmp","id":"string-231","level":"informative","mitre_attack_id":"T1562.001","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00000628.00000000.186903.011F1000.00000002.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Able to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a0ff07b00d126b29804de04","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"