24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TROJ_TAPAOUX.B Sample 2db8a9c40191… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2db8a9c40191…. Malware family: TROJ_TAPAOUX.B. Threat score 100/100. 19/28 AV engines flagged this file. 10 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10","keywords":["Malicious","TROJ_TAPAOUX.B","malware analysis","sandbox report","threat intelligence","2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TROJ_TAPAOUX.B","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T50b,".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{6401AE4C-27CE-C416-167C-CEF5629CED3F}") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{6401AE4C-27CE-C416-167C-CEF5629CED3F}"; Key: "STUBPATH"; Value: ""%WINDIR%\system32\xflash.exe" SystemBasicTools") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{6401AE4C-27CE-C416-167C-CEF5629CED3F}"; Key: "(DEFAULT)"; Value: "Microsoft Explorer"), ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{6401AE4C-27CE-C416-167C-CEF5629CED3F}"; Key: "VERSION"; Value: "1 0 0 1"), ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{6401AE4C-27CE-C416-167C-CEF5629CED3F}"; Key: "ISINSTALLED"; Value: "01000000"), ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{6401AE4C-27CE-C416-167C-CEF5629CED3F}"), ".exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{6401AE4C-27CE-C416-167C-CEF5629CED3F}"; Key: "VERSION"; Value: "1 0 0 0")26:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791488594093,"unified_at":"2026-10-08T19:43:14.093Z","metadata":{"hashes":{"sha256":"2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10","sha1":"0d941f58d554a9970e50adb353193ea3525f9c8f","md5":"043d308bfda76e35122567cf933e1b2a","sha512":"38ec0d60093b277d01a11b749684d8a8a52c80612103c821e3e89a43821db6720165413e2a08d2af13611ef492477e168a3c4a7bf2e574c23d3ce721342bdf08","ssdeep":"6144:iMIiwuHaiRm/pArfD31+JdQIsXnrgQyG57piAilu27Vgz8A:dwuH8eDEmjbgpGDizLuz8A","ssdeep_chunks":["6144:iMIiwuH","6144:MIiwuHa","6144:IiwuHai","6144:iwuHaiR","6144:wuHaiRm","6144:uHaiRm/","6144:HaiRm/p","6144:aiRm/pA","6144:iRm/pAr","6144:Rm/pArf","6144:m/pArfD","6144:/pArfD3","6144:pArfD31","6144:ArfD31+","6144:rfD31+J","6144:fD31+Jd","6144:D31+JdQ","6144:31+JdQI","6144:1+JdQIs","6144:+JdQIsX","6144:JdQIsXn","6144:dQIsXnr","6144:QIsXnrg","6144:IsXnrgQ","6144:sXnrgQy","6144:XnrgQyG","6144:nrgQyG5","6144:rgQyG57","6144:gQyG57p","6144:QyG57pi","6144:yG57piA","6144:G57piAi","6144:57piAil","6144:7piAilu","6144:piAilu2","6144:iAilu27","6144:Ailu27V","6144:ilu27Vg","6144:lu27Vgz","6144:u27Vgz8","6144:27Vgz8A","12288:iMIiwuH","12288:MIiwuHa","12288:IiwuHai","12288:iwuHaiR","12288:wuHaiRm","12288:uHaiRm/","12288:HaiRm/p","12288:aiRm/pA","12288:iRm/pAr","12288:Rm/pArf","12288:m/pArfD","12288:/pArfD3","12288:pArfD31","12288:ArfD31+","12288:rfD31+J","12288:fD31+Jd","12288:D31+JdQ","12288:31+JdQI","12288:1+JdQIs","12288:+JdQIsX","12288:JdQIsXn","12288:dQIsXnr","12288:QIsXnrg","12288:IsXnrgQ","12288:sXnrgQy","12288:XnrgQyG","12288:nrgQyG5","12288:rgQyG57","12288:gQyG57p","12288:QyG57pi","12288:yG57piA","12288:G57piAi","12288:57piAil","12288:7piAilu","12288:piAilu2","12288:iAilu27","12288:Ailu27V","12288:ilu27Vg","12288:lu27Vgz","12288:u27Vgz8","12288:27Vgz8A","6144:dwuH8eD","6144:wuH8eDE","6144:uH8eDEm","6144:H8eDEmj","6144:8eDEmjb","6144:eDEmjbg","6144:DEmjbgp","6144:EmjbgpG","6144:mjbgpGD","6144:jbgpGDi","6144:bgpGDiz","6144:gpGDizL","6144:pGDizLu","6144:GDizLuz","6144:DizLuz8","6144:izLuz8A"],"imphash":"94fa257df4363d1ca827a253af16d87c"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":357344,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1595547424000,"last_seen":1677505264000,"last_multi_scan":1677505264000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["tapaoux"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":21},"sandbox_signatures":{"informative_count":16,"suspicious_count":11,"malicious_count":10,"total":37},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Dropper/Win.Mudrop","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Tusha","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Tapaoux.A.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.356649","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-631356","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.356649 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Agent.QYH trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0015d1211 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Win32.Agent.buxs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXCB-RB!043D308BFDA7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Drop.bgdoxj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agent.357344","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_TAPAOUX.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_TAPAOUX.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Agent.Win32.36894","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TROJ_TAPAOUX.B","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Command-Line Interface","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Drops or executes a batch file"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"malicious","value":"Drops system driver"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/techniques/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/techniques/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/techniques/T1063","identifiers":[{"type":"malicious","value":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Contains a remote desktop related string"},{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Persistence","technique":"Active Setup","attack_id":"T1547.014","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/014","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry (Active Setup)"}],"sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Marks file for deletion"},{"type":"informative","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Contains a remote desktop related string"},{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c C:\\SystemCheck.bat\" on 2020-7-23.23:38:27.468","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c C:\\SystemCheck.bat\" (UID: 00291012-00000356)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c C:\\SystemCheck.bat\" (UID: 00291012-00000356)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Root Agency\" (SHA1: 3F:70:36:55:2C:3C:BE:0F:60:AE:99:B4:27:DE:16:1E:E3:B6:3A:AA; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"SystemCheck.bat\" has type \"ASCII text with CRLF line terminators\"\n \"cdboot.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"xflash.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"xflash.sys\" has type \"PE32 executable (native) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"cmd.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\System32\\cdboot.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\xflash.exe\"\n \".exe\" touched file \"%WINDIR%\\System32\\xflash.sys\"\n \".exe\" touched file \"%WINDIR%\\System32\\tzres.dll\"\n \".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.microsoft.com0\"\n Heuristic match: \"Microsoft.IN\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"cdboot.dll\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"xflash.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"xflash.sys\" was detected as \"Visual C++ 2003 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.65787411621","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"cdboot.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"xflash.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"xflash.sys\" has type \"PE32 executable (native) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$25","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"&I9\"v/\nj\\0H)&vncdf\" (Indicator for product: Generic VNC)","origin":"File/Memory","mitre_attack_id":"T1076","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10.bin\" claimed CRC 405841 while the actual is CRC 399083\n \"cdboot.dll\" claimed CRC 161554 while the actual is CRC 220331\n \"xflash.sys\" claimed CRC 60887 while the actual is CRC 177031","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n CreateServiceA\n StartServiceA\n RegCreateKeyExA\n RegOpenKeyExA\n GetFileAttributesA\n WriteFile\n DeviceIoControl\n CopyFileA\n GetModuleFileNameA\n LoadLibraryExA\n UnhandledExceptionFilter\n TerminateProcess\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetProcAddress\n FindFirstFileA\n CreateFileA\n LockResource\n GetCommandLineA\n GetModuleHandleA\n CreateProcessA\n Sleep\n FindResourceA\n VirtualAlloc\n GetWindowThreadProcessId\n GetLastActivePopup\n SetWindowsHookExA\n WriteProcessMemory\n CreateThread\n CreateToolhelp32Snapshot\n Process32First\n VirtualProtect\n Process32Next\n CreateRemoteThread\n OpenProcess\n GetComputerNameA\n FindNextFileA\n VirtualAllocEx\n WinExec\n HttpSendRequestA\n InternetWriteFile\n InternetCloseHandle\n InternetOpenA\n InternetReadFile\n InternetConnectA\n HttpQueryInfoA\n HttpSendRequestExA\n socket\n recv\n send\n WSAStartup\n connect\n closesocket\n RegDeleteKeyA\n OpenProcessToken\n RegEnumKeyExA\n RegDeleteValueA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Reads Antivirus engine related registry keys","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\RISING\\\\RIS\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\TRENDMICRO\\PC-CILLIN\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\ESET\\ESET SECURITY\\CURRENT VERSION\\INFO\")","origin":"Registry Access","mitre_attack_id":"T1063","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"VMware trick\" in \"2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10.bin\" (Offset: 46440)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"56/68 Antivirus vendors marked sample as malicious (82% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"56/68 Antivirus vendors marked sample as malicious (82% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"15/42 Antivirus vendors marked dropped file \"cdboot.dll\" as malicious (classified as \"Trojan.Agent\" with 35% detection rate)\n 14/42 Antivirus vendors marked dropped file \"xflash.exe\" as malicious (classified as \"Trojan.Agent\" with 33% detection rate)\n 38/57 Antivirus vendors marked dropped file \"xflash.sys\" as malicious (classified as \"Rootkit.36290\" with 66% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%WINDIR%\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"malicious","category":"Installation/Persistance","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\System32\\cdboot.dll\"\n File type \"PE32 executable (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\System32\\xflash.exe\"\n File type \"PE32 executable (native) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\System32\\xflash.sys\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Drops system driver","description":"\"xflash.sys\" has type \"PE32 executable (native) Intel 80386 for MS Windows\"","origin":"Binary File","mitre_attack_id":"T1215","relevance":10,"id":"binary-2","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"General","name":"Drops or executes a batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c C:\\SystemCheck.bat\" (UID: 00000000-00001196)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00001196) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00001196) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"%WINDIR%\\SysWOW64\\cmd.exe\" marked \"C:\\2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"cmd.exe\" opened \"C:\\2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry (Active Setup)","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{86CD17C4-1CE4-78CF-3C4F-4AEF5633CF28}\"; Key: \"VERSION\"; Value: \"1,0,0,0\")\n \".exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{86CD17C4-1CE4-78CF-3C4F-4AEF5633CF28}\")","origin":"Registry Access","mitre_attack_id":"T1547.014","relevance":8,"id":"registry-85","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"c0df0a771cf90977ccf809770d640b7700000000c011ff7500000000fc3eff7500000000e013ff75000000009457ea7425e00a77c6e00a7700000000bc6ae97400000000cf31ff75000000009319ea74000000002c32ff7500000000\" to virtual address \"0x74E11000\" (part of module \"NSI.DLL\")\n \".exe\" wrote bytes \"711194007a3b9300ab8b02007f950200fc8c0200729602006cc805001ecd90007d269000\" to virtual address \"0x767C07E4\" (part of module \"USER32.DLL\")\n \"cmd.exe\" wrote bytes \"c0df0a771cf90977ccf809770d640b7700000000c011ff7500000000fc3eff7500000000e013ff75000000009457ea7425e00a77c6e00a7700000000bc6ae97400000000cf31ff75000000009319ea74000000002c32ff7500000000\" to virtual address \"0x74E11000\" (part of module \"NSI.DLL\")\n \"cmd.exe\" wrote bytes \"711194007a3b9300ab8b02007f950200fc8c0200729602006cc805001ecd90007d269000\" to virtual address \"0x767C07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Reads terminal service related keys (often RDP related)"},{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":31,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["tapaoux"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"620543f4043b6c1f1407e3b1","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Tapaoux","submit_name":"2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10","analysis_start_time":"2022-02-10T16:57:26+00:00","indicators_count":{"informative":14,"suspicious":14,"malicious":8},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"61f983ed14792c67495067c2","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Tapaoux","submit_name":"2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10","analysis_start_time":"2022-02-01T19:03:15+00:00","indicators_count":{"informative":15,"suspicious":14,"malicious":8},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"5f1a1f20c937135b7e0c7e7d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dropper.Trojan.Generic","submit_name":"2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10","analysis_start_time":"2020-07-23T23:37:09+00:00","indicators_count":{"informative":11,"suspicious":12,"malicious":9},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}],"processes":[{"pid":2588,"ppid":0,"name":"2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10.exe","command_line":"","sha256":"2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10","normalized_path":"C:\\2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10.exe","uid":"00290877-00002588","icon":"$26"},{"pid":356,"ppid":2588,"name":"cmd.exe","command_line":"/c C:\\SystemCheck.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00290877-00002588","uid":"00291012-00000356"}],"all_imported_dlls":["usp10.dll","msctf.dll","kernel32.dll","advapi32.dll","ole32.dll","rpcrt4.dll","shell32.dll","uxtheme.dll","user32.dll","shlwapi.dll","imm32.dll","rpcss.dll","cryptbase.dll","comdlg32.dll","api-ms-win-core-synch-l1-2-0.dll","comctl32.dll","apphelp.dll","msvcrt.dll","sechost.dll","KernelBase.dll","oleaut32.dll","winbrand.dll","ntdll.dll","gdi32.dll","lpk.dll","ws2_32.dll","wow64cpu.dll","nsi.dll","wow64.dll","wow64win.dll","sspicli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"cdboot.dll","sha256":"020d5c2f6d1617bae58b7aade69970aee0c235ce0eb0505e32d3b6876275cb1c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"name":"xflash.exe","sha256":"3873ba0db8eb807bfa4787b4a8e5c66b35684ffac79f310335fa41b006abaa45","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"name":"xflash.sys","sha256":"3ad6d4325aa75c74c2c52d71d12b0c92b854de17df11efae25238e97688fd1ae","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"name":"SystemCheck.bat","sha256":"a209f7898c814f2941223b7da475e861fb46c8406e9ba675336021ec9a9a40a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"},{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"},{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"name":"biosfix.dll","sha256":"020d5c2f6d1617bae58b7aade69970aee0c235ce0eb0505e32d3b6876275cb1c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"}]},{"name":"xmlhelp.exe","sha256":"3873ba0db8eb807bfa4787b4a8e5c66b35684ffac79f310335fa41b006abaa45","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"}]},{"name":"xmlhelp.sys","sha256":"3ad6d4325aa75c74c2c52d71d12b0c92b854de17df11efae25238e97688fd1ae","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"}]},{"name":"countryfix.dll","sha256":"020d5c2f6d1617bae58b7aade69970aee0c235ce0eb0505e32d3b6876275cb1c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"name":"autocheck.exe","sha256":"3873ba0db8eb807bfa4787b4a8e5c66b35684ffac79f310335fa41b006abaa45","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"name":"autocheck.sys","sha256":"3ad6d4325aa75c74c2c52d71d12b0c92b854de17df11efae25238e97688fd1ae","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"path":"%WINDIR%\\System32\\xflash.exe","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"path":"%WINDIR%\\System32\\xflash.sys","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"path":"C:\\SystemCheck.bat","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"path":"%WINDIR%\\System32\\cdboot.dll","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{6401AE4C-27CE-C416-167C-CEF5629CED3F}\\","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{6401AE4C-27CE-C416-167C-CEF5629CED3F}\\","sources":[{"report_type":"sandbox","report_id":"5f1a1f20c937135b7e0c7e7d"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{86CD17C4-1CE4-78CF-3C4F-4AEF5633CF28}\\","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{86CD17C4-1CE4-78CF-3C4F-4AEF5633CF28}\\","sources":[{"report_type":"sandbox","report_id":"61f983ed14792c67495067c2"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{537ACDEF-2672-3341-CCEA-2BE4DE1673DF}\\","sources":[{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{537ACDEF-2672-3341-CCEA-2BE4DE1673DF}\\","sources":[{"report_type":"sandbox","report_id":"620543f4043b6c1f1407e3b1"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["620543f4043b6c1f1407e3b1","61f983ed14792c67495067c2","5f1a1f20c937135b7e0c7e7d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious TROJ_TAPAOUX.B Sample 2db8a9c40191… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2db8a9c40191…. Malware family: TROJ_TAPAOUX.B. Threat score 100/100. 19/28 AV engines flagged this file. 10 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10"}],["$","meta","4",{"property":"og:title","content":"Malicious TROJ_TAPAOUX.B Sample 2db8a9c40191… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2db8a9c40191…. Malware family: TROJ_TAPAOUX.B. Threat score 100/100. 19/28 AV engines flagged this file. 10 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TROJ_TAPAOUX.B Sample 2db8a9c40191… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2db8a9c40191…. Malware family: TROJ_TAPAOUX.B. Threat score 100/100. 19/28 AV engines flagged this file. 10 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]