24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 2e500b2f160f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2e500b2f160f…. Malware family: Malware. Threat score 100/100. 18/28 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2e500b2f160f927b1140fb105b83300ca21762c21bb6195c44e8dc613f7d7b12","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","2e500b2f160f927b1140fb105b83300ca21762c21bb6195c44e8dc613f7d7b12"],"about":{"@type":"SoftwareApplication","name":"85b57d7791c6ca66388316d2f17fc0bc.exe","applicationCategory":["peexe","executable"],"identifier":"2e500b2f160f927b1140fb105b83300ca21762c21bb6195c44e8dc613f7d7b12","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T601,SetUnhandledExceptionFilter@KERNEL32.dll at 47948-3039-00435B02 SetUnhandledExceptionFilter@KERNEL32.dll at 47948-3003-0043481A SetUnhandledExceptionFilter@KERNEL32.dll at 47948-6737-00481503 SetUnhandledExceptionFilter@KERNEL32.dll at 47948-4077-00430A9A SetUnhandledExceptionFilter@KERNEL32.dll at 47948-4122-00430AD6 SetUnhandledExceptionFilter@KERNEL32.dll at 47948-4113-00435B29 SetUnhandledExceptionFilter@KERNEL32.DLL at 00013895-00002808-52153-12-004823F4 SetUnhandledExceptionFilter@KERNEL32.DLL at 00013895-00002808-52153-33-0047E35F SetUnhandledExceptionFilter@KERNEL32.DLL at 00013895-00002808-52153-1503-0043481A SetUnhandledExceptionFilter@KERNEL32.DLL at 00013895-00002808-52153-1539-00435B02 SetUnhandledExceptionFilter@KERNEL32.DLL at 00013895-00002808-52153-2609-00430AD6 SetUnhandledExceptionFilter@KERNEL32.DLL at 00013895-00002808-52153-2600-00435B29 SetUnhandledExceptionFilter@KERNEL32.DLL at 00013895-00002808-52153-2564-00430A9A SetUnhandledExceptionFilter@KERNEL32.DLL at 00013895-00002808-52153-4230-00481503 SetUnhandledExceptionFilter@KERNEL32.DLL at 00014079-00002068-58789-33-00F88A57 SetUnhandledExceptionFilter@KERNEL32.DLL at 00014079-00002068-58789-12-00F883E7 SetUnhandledExceptionFilter@KERNEL32.DLL at 00014079-00002068-58789-351-00F8638D SetUnhandledExceptionFilter@KERNEL32.DLL at 00014265-00003944-61280-33-0042DCEB SetUnhandledExceptionFilter@KERNEL32.DLL at 00014265-00003944-61280-12-00431772 SetUnhandledExceptionFilter@KERNEL32.DLL at 00014265-00003944-61280-1653-004317FE26:T43f,Found API call GetSystemTimeAsFileTime@KERNEL32.dll directly followed by "cmp dword ptr [ebp+28h], ebx" and "push dword ptr [ebp+24h]" at 47948-3081-00433300 Found API call GetSystemTimeAsFileTime@KERNEL32.dll directly followed by "cmp dword ptr [ebp+20h], ebx" and "push dword ptr [ebp+1Ch]" at 47948-4103-00435D9B Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp dword ptr [esp+0000020Ch], 05h" and "jne 0047C7E0h" at 00013895-00002808-52153-46-0047C505 Found API call GetSystemTimeAsFileTime@KERNEL32.DLL directly followed by "cmp dword ptr [ebp+28h], ebx" and "push dword ptr [ebp+24h]" at 00013895-00002808-52153-1581-00433300 Found API call GetSystemTimeAsFileTime@KERNEL32.DLL directly followed by "cmp dword ptr [ebp+20h], ebx" and "push dword ptr [ebp+1Ch]" at 00013895-00002808-52153-2590-00435D9B Found API call GetLocalTime@KERNEL32.dll directly followed by "cmp edx, dword ptr [10037EE8h]" and "jnl 10004194h" at 6424-709-10004110 Found API call GetVersionExA@KERNEL32.dll directly followed by "cmp eax, 01h" and "jne 10003243h" at 6424-713-1000317027:T446,"" touched file "C:\Windows\AppPatch\sysmain.sdb" "SVCHOST.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "explorer.exe" touched file "C:\Windows\System32" "explorer.exe" touched file "C:\Windows\System32\sysprep\sysprep.exe" "explorer.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "explorer.exe" touched file "C:\Windows\System32\sysprep" "explorer.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk" "explorer.exe" touched file "C:\Windows\System32\msconfig.exe" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\dcd5734867e97.customDestinations-ms" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\cbc036d6fdb69fb5.customDestinations-ms"28:T92c,"" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\SVCHOST.exe" (Handle: 56) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\SVCHOST.exe" (Handle: 56) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\SVCHOST.exe" (Handle: 56) "SVCHOST.exe" wrote 96 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 56 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 28 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 84 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 80 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 158 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 24 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 20 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 13 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 15 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 12 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 17 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 16 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 134 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 1120 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "explorer.exe" wrote 32 bytes to a remote process "C:\Windows\System32\sysprep\sysprep.exe" (Handle: 3032) "explorer.exe" wrote 52 bytes to a remote process "C:\Windows\System32\sysprep\sysprep.exe" (Handle: 3032) "explorer.exe" wrote 4 bytes to a remote process "C:\Windows\System32\sysprep\sysprep.exe" (Handle: 3032) "sysprep.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\w7e89.tmp" (Handle: 324) "sysprep.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\w7e89.tmp" (Handle: 324) "sysprep.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\w7e89.tmp" (Handle: 324)29:T75c,YARA signature "Codoso_Gh0st_1" classified file "85b57d7791c6ca66388316d2f17fc0bc.exe.bin" as "apt,codoso,plugx" based on indicators: "45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a007b00330061006400300035003500370035002d0038003800350037002d0034003800350030002d0039003200370037002d003100310062003800350062006400620038006500300039007d00,45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a00" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, Author: Florian Roth) YARA signature "Codoso_Gh0st_1" classified file "SVCHOST.exe" as "apt,codoso,plugx" based on indicators: "45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a007b00330061006400300035003500370035002d0038003800350037002d0034003800350030002d0039003200370037002d003100310062003800350062006400620038006500300039007d00,45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a00" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, Author: Florian Roth) YARA signature "Codoso_Gh0st_2" classified file "SVCHOST.exe" as "apt,codoso,plugx" based on indicators: "45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a007b00330061006400300035003500370035002d0038003800350037002d0034003800350030002d0039003200370037002d003100310062003800350062006400620038006500300039007d00" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, Author: Florian Roth) Internal YARA signature matched on process "85b57d7791c6ca66388316d2f17fc0bc.exe" Internal YARA signature matched on process "w7e89.tmp" Internal YARA signature matched on file "all.bstring"2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2e500b2f160f927b1140fb105b83300ca21762c21bb6195c44e8dc613f7d7b12","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790729694918,"unified_at":"2026-09-30T00:54:54.918Z","metadata":{"hashes":{"sha256":"2e500b2f160f927b1140fb105b83300ca21762c21bb6195c44e8dc613f7d7b12","sha1":"9076b865017a06a5f1ce918896f592c237ccaf44","md5":"152b264288bcf5dc02222cee49587b8e","sha512":"5d954cb9997bbd43062e3ce4a4cfa715758569caf9517d84158df51b3f37bed8b0c0d9b4dd733734648d02dcb4d0b72194515b352b4005837bf9e4fefec35c42","ssdeep":"12288:W3Wi9rZJ+FEFA43YOfx1U8mZbdhGbkv9xeIuq1o1R7:6WiR7+SAH0s8SLGFq2H7","ssdeep_chunks":["12288:W3Wi9rZ","12288:3Wi9rZJ","12288:Wi9rZJ+","12288:i9rZJ+F","12288:9rZJ+FE","12288:rZJ+FEF","12288:ZJ+FEFA","12288:J+FEFA4","12288:+FEFA43","12288:FEFA43Y","12288:EFA43YO","12288:FA43YOf","12288:A43YOfx","12288:43YOfx1","12288:3YOfx1U","12288:YOfx1U8","12288:Ofx1U8m","12288:fx1U8mZ","12288:x1U8mZb","12288:1U8mZbd","12288:U8mZbdh","12288:8mZbdhG","12288:mZbdhGb","12288:ZbdhGbk","12288:bdhGbkv","12288:dhGbkv9","12288:hGbkv9x","12288:Gbkv9xe","12288:bkv9xeI","12288:kv9xeIu","12288:v9xeIuq","12288:9xeIuq1","12288:xeIuq1o","12288:eIuq1o1","12288:Iuq1o1R","12288:uq1o1R7","24576:W3Wi9rZ","24576:3Wi9rZJ","24576:Wi9rZJ+","24576:i9rZJ+F","24576:9rZJ+FE","24576:rZJ+FEF","24576:ZJ+FEFA","24576:J+FEFA4","24576:+FEFA43","24576:FEFA43Y","24576:EFA43YO","24576:FA43YOf","24576:A43YOfx","24576:43YOfx1","24576:3YOfx1U","24576:YOfx1U8","24576:Ofx1U8m","24576:fx1U8mZ","24576:x1U8mZb","24576:1U8mZbd","24576:U8mZbdh","24576:8mZbdhG","24576:mZbdhGb","24576:ZbdhGbk","24576:bdhGbkv","24576:dhGbkv9","24576:hGbkv9x","24576:Gbkv9xe","24576:bkv9xeI","24576:kv9xeIu","24576:v9xeIuq","24576:9xeIuq1","24576:xeIuq1o","24576:eIuq1o1","24576:Iuq1o1R","24576:uq1o1R7","12288:6WiR7+S","12288:WiR7+SA","12288:iR7+SAH","12288:R7+SAH0","12288:7+SAH0s","12288:+SAH0s8","12288:SAH0s8S","12288:AH0s8SL","12288:H0s8SLG","12288:0s8SLGF","12288:s8SLGFq","12288:8SLGFq2","12288:SLGFq2H","12288:LGFq2H7"],"imphash":"dd862027ea7a1cfbce47b6c5e9ec6582"},"file_info":{"file_name":"85b57d7791c6ca66388316d2f17fc0bc.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":795136,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1528732423000,"last_seen":1664702262000,"last_multi_scan":1664702262000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["dembr","gop","guardianofpeace","irc","ircbot","konni","operationtroy","rbot","silentchollima","sleperbot","targeted","tdrop","whoisteam","apt","apt19","c0d0so","codoso","plugx","sunshopgroup"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":22,"suspicious_count":18,"malicious_count":13,"total":53},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Agent.795136.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Unknown","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.Agent.DZPG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.Agent.DZPG (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Keydoor.N trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Spy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Win32.Agent.bjpxyr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Swizzor.bpfkwv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agent.795136.AK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.0C2F5719","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.0C2F5719","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Swizzor.BAPG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan-Spy.Zbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$25","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 47948-3044-00435791\n GetSystemTimeAsFileTime@KERNEL32.dll at 47948-4111-0043715B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00013895-00002808-52153-199-00481FE5\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00013895-00002808-52153-1544-00435791\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00013895-00002808-52153-2598-0043715B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00014079-00002068-58789-157-00F8766F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00014265-00003944-61280-210-004322E0\n GetLocalTime@KERNEL32.dll at 6424-558-1000BD90\n GetLocalTime@KERNEL32.dll at 6424-560-1000BAF0\n GetLocalTime@KERNEL32.dll at 6424-678-10005EB0\n GetLocalTime@KERNEL32.dll at 6424-725-10003620\n GetSystemTimeAsFileTime@KERNEL32.dll at 6424-723-1000F111\n GetLocalTime@KERNEL32.dll at 6424-805-100025C0\n GetLocalTime@KERNEL32.dll at 6424-820-1000BC50","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00013895-00002808-52153-46-0047C505\n GetVersionExA@KERNEL32.dll at 6424-713-10003170","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$26","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 47948-3010-004335E4\n GetProcessHeap@KERNEL32.DLL at 00013895-00002808-52153-119-0048547F\n GetProcessHeap@KERNEL32.DLL at 00013895-00002808-52153-1510-004335E4\n GetProcessHeap@KERNEL32.DLL at 00014265-00003944-61280-118-004351CD\n GetProcessHeap@KERNEL32.dll at 6424-617-1001C8CA","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.kimkeyfan.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.110.30.223:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"F:\\WORKING\\Win7ElevateV2_Source\\Win32\\Release\\Win7ElevateDll32.pdb\"\n \"F:\\WORKING\\Win7ElevateV2_Source\\x64\\Release\\Win7ElevateDll64.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\SVCHOST.exe\"\n \"\" created file \"%TEMP%\\w7e89.tmp\"\n \"\" created file \"%TEMP%\\ud.bat\"\n \"SVCHOST.exe\" created file \"%TEMP%\\w7e2C76.tmp\"\n \"w7e89.tmp\" created file \"%TEMP%\\~ER354E.tmp\"\n \"w7e89.tmp\" created file \"%TEMP%\\~RF833B.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}\"\n \"{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}\"\n \"\\Sessions\\1\\BaseNamedObjects\\SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\WdsSetupLogInit\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog\"\n \"Global\\SetupLog\"\n \"SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc\"\n \"Global\\WdsSetupLogInit\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"explorer.exe\" (UID: 00014225-00001468) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"explorer.exe\" (UID: 00014225-00001468) was launched with modified environment variables: \"Path\"\n Process \"explorer.exe\" (UID: 00014225-00001468) was launched with missing environment variables: \"PROMPT\"\n Process \"cmd.exe\" (UID: 00014599-00002932) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00014599-00002932) was launched with modified environment variables: \"Path\"\n Process \"cmd.exe\" (UID: 00014599-00002932) was launched with missing environment variables: \"SESSIONNAME\"\n Process \"cmd.exe\" (UID: 00016451-00002260) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"cmd.exe\" (UID: 00016451-00002260) was launched with modified environment variables: \"Path\"\n Process \"cmd.exe\" (UID: 00016451-00002260) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c %TEMP%\\\\ud.bat\" on 2018-6-11.16:52:37.917\n \"cmd /c %TEMP%\\~RF833B.bat\" on 2018-6-11.16:52:56.424","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"SVCHOST.exe\" with commandline \"\"%TEMP%\\w7e89.tmp\"\" (UID: 00014079-00002068)\n Spawned process \"sysprep.exe\" with commandline \"\"\"%TEMP%\\w7e89.tmp\"\" \"%WINDIR%\\system32\" \"*n/a\"\" (UID: 00014242-00004044)\n Spawned process \"w7e89.tmp\" with commandline \"*n/a\" (UID: 00014265-00003944)\n Spawned process \"cmd.exe\" with commandline \"cmd /c %TEMP%\\\\ud.bat\" (UID: 00014599-00002932)\n Spawned process \"cmd.exe\" with commandline \"cmd /c %TEMP%\\~RF833B.bat\" (UID: 00016451-00002260)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"POST /bbs/login_ok.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; InfoPath.2)Host: www.kimkeyfan.comContent-Length: 67Connection: Keep-AliveCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"sysprep.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"ud.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"\n \"~RF833B.bat\" has type \"ASCII text with CRLF line terminators\"\n \"SVCHOST.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"diagerr.xml\" has type \"UTF-8 Unicode (with BOM) text with very long lines\"\n \"setuperr.log\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"\n \"~ER354E.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"w7e89.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"setupact.log\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"\n \"w7e2C76.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"diagwrn.xml\" has type \"UTF-8 Unicode (with BOM) text\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"cmd.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.kimkeyfan.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"w7e89.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESSKIT\"; Key: \"TYPE\"; Value: \"20000000\")\n \"w7e89.tmp\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SHAREDACCESSKIT\\PARAMETERS\")\n \"w7e89.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESSKIT\\PARAMETERS\"; Key: \"SERVICEDLL\"; Value: \"%SystemRoot%\\System32\\msipnathlp.dll\")\n \"w7e89.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESSKIT\\PARAMETERS\"; Key: \"SERVICEMAIN\"; Value: \"ServiceMain\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"85b57d7791c6ca66388316d2f17fc0bc.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"SVCHOST.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"~ER354E.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"w7e89.tmp\" was detected as \"VC8 -> Microsoft Corporation\"\n \"w7e2C76.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"sysprep.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceA@ADVAPI32.DLL at 00014265-00003944-61280-149-0042C98A","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00013895-00002808-00000105-4334313815\n \"SVCHOST.exe\" queried SystemProcessInformation at 00014079-00002068-00000105-7671665804","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 11 calls to GetProcAddress@KERNEL32.DLL at 00014079-00002068-58789-132-00F81000","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 2509-275-10006988\n cpuid at 4275-727-00415DC0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"sysprep.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"w7e89.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/64 reputation engines marked \"http://www.kimkeyfan.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"w7e89.tmp\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)\n \"w7e89.tmp\" called \"OpenSCManager\" requesting access rights \"0X20000000\"","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /bbs/login_ok.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; InfoPath.2)Host: www.kimkeyfan.comContent-Length: 67Connection: Keep-AliveCache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to create a remote thread (often used for process injection)","description":"CreateRemoteThread@KERNEL32.DLL at 00014079-00002068-58789-51-00F82BC0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-5","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to write to a remote process","description":"WriteProcessMemory@KERNEL32.DLL at 00014079-00002068-58789-52-00F843D0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-34","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%TEMP%\\SVCHOST.exe\", Handle: 56)\n \"\" is creating a new process\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 56)\n \"explorer.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\sysprep\\sysprep.exe\", Handle: 3032)\n \"sysprep.exe\" is creating a new process (Name: \"%TEMP%\\w7e89.tmp\", Handle: 324)\n \"w7e89.tmp\" is creating a new process\n \"w7e89.tmp\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 41564)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"SVCHOST.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"~ER354E.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"w7e89.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"w7e2C76.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; InfoPath.2)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00013895-00002808-52153-137-0047C393\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00014079-00002068-58789-122-00F83B90","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%TEMP%\\SVCHOST.exe\" marked \"%TEMP%\\w7e2C76.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\\"%TEMP%\\SVCHOST.exe\" \"%TEMP%\\w7e89.tmp\"\" with delete access\n \"SVCHOST.exe\" opened \"%TEMP%\\w7e2C76.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"~ER354E.tmp\" claimed CRC 198762 while the actual is CRC 144562\n \"w7e2C76.tmp\" claimed CRC 59968 while the actual is CRC 287735","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n WinExec\n DeleteFileA\n UnhandledExceptionFilter\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n LoadLibraryW\n GetModuleHandleA\n WriteFile\n GetModuleHandleW\n TerminateProcess\n CreateProcessA\n CreateFileW\n Sleep\n GetTickCount\n CreateFileA\n OpenProcessToken\n CreateToolhelp32Snapshot\n VirtualAllocEx\n CreateRemoteThread\n WriteProcessMemory\n OpenProcess\n GetCommandLineW\n DeleteFileW\n VirtualProtectEx\n Process32FirstW\n GetTempFileNameW\n Process32NextW\n GetTempPathW\n RegCloseKey\n RegOpenKeyExA\n CryptEncrypt\n RegCreateKeyExA\n CreateFileMappingA\n GetFileAttributesA\n GetDriveTypeA\n OpenFileMappingA\n CreateThread\n GetVersionExA\n ExitThread\n GetFileSize\n CreateDirectoryA\n FindFirstFileA\n GetComputerNameA\n FindNextFileA\n MapViewOfFile\n CreateServiceA\n StartServiceA\n RegEnumKeyExA\n GetStartupInfoA\n CreateProcessW\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"SVCHOST.exe\" at non-system pathway \"%TEMP%\\SVCHOST.exe\" with commandline \"\"%TEMP%\\w7e89.tmp\"\" (UID: 00014079-00002068)","origin":"Monitored Target","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Found a system process name at an unusual pathway","description":"Process \"SVCHOST.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00014079-00002068)","origin":"Monitored Target","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ETPRO TROJAN Xwdoor Variant HTTP CnC Beacon\" (SID: 2828151, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"41/64 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"41/64 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"42/65 Antivirus vendors marked dropped file \"SVCHOST.exe\" as malicious (classified as \"Gen:Trojan.Heur.RP\" with 64% detection rate)\n 39/65 Antivirus vendors marked dropped file \"~ER354E.tmp\" as malicious (classified as \"Gen:Trojan.Heur.LP\" with 60% detection rate)\n 44/66 Antivirus vendors marked dropped file \"w7e89.tmp\" as malicious (classified as \"Gen:Trojan.Heur\" with 66% detection rate)\n 27/66 Antivirus vendors marked dropped file \"w7e2C76.tmp\" as malicious (classified as \"Agent.43520\" with 40% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"42/65 Antivirus vendors marked spawned process \"SVCHOST.exe\" (PID: 2068) as malicious (classified as \"Gen:Trojan.Heur.RP\" with 64% detection rate)\n 44/66 Antivirus vendors marked spawned process \"w7e89.tmp\" (PID: 3944) as malicious (classified as \"Gen:Trojan.Heur\" with 66% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"SVCHOST.exe\" allocated memory in \"%TEMP%\\w7e2C76.tmp\"\n \"w7e89.tmp\" allocated memory in \"%WINDIR%\\AppPatch\\sysmain.sdb\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00014225-00001468)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2018-6-11.16:52:34.150 (UID: 00014225-00001468)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$28","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$29","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00013895-00002808)\n Spawned process \"SVCHOST.exe\" with commandline \"\"%TEMP%\\w7e89.tmp\"\" (UID: 00014079-00002068)\n Spawned process \"sysprep.exe\" with commandline \"\"\"%TEMP%\\w7e89.tmp\"\" \"%WINDIR%\\system32\" \"*n/a\"\" (UID: 00014242-00004044)\n Spawned process \"w7e89.tmp\" with commandline \"*n/a\" (UID: 00014265-00003944)\n Spawned process \"cmd.exe\" with commandline \"cmd /c %TEMP%\\\\ud.bat\" (UID: 00014599-00002932)\n Spawned process \"cmd.exe\" with commandline \"cmd /c %TEMP%\\~RF833B.bat\" (UID: 00016451-00002260)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Injects into remote processes"},{"detail":"Spawns a lot of processes"},{"detail":"Injects into explorer"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":36,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":46,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["dembr","gop","guardianofpeace","irc","ircbot","konni","operationtroy","rbot","silentchollima","sleperbot","targeted","tdrop","whoisteam","apt","apt19","c0d0so","codoso","plugx","sunshopgroup"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5b1e9b067ca3e15c2232e883","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Trojan.Heur.JP","contacted_countries":["USA"],"submit_name":"85b57d7791c6ca66388316d2f17fc0bc.exe","analysis_start_time":"2018-06-11T16:51:17+00:00","indicators_count":{"informative":22,"suspicious":19,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.110.30.223","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]}],"dns_resolutions":[{"domain":"www.kimkeyfan.com","address":"23.110.30.223","ttl":3599,"country":"United States","registrar_name":"Chengdu west dimension digital technology Co., LTD","registrar_organization":"Mu Zhi Kui","registrar_creation_date":"2018-03-21T13:47:15+00:00","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]}],"http_requests":[{"host":"www.kimkeyfan.com","host_ip":"23.110.30.223:80","url":"/bbs/login_ok.php","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /bbs/login_ok.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; InfoPath.2)\nHost: www.kimkeyfan.com\nContent-Length: 67\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}],"processes":[{"pid":2808,"ppid":0,"name":"85b57d7791c6ca66388316d2f17fc0bc.exe","command_line":"","sha256":"2e500b2f160f927b1140fb105b83300ca21762c21bb6195c44e8dc613f7d7b12","normalized_path":"C:\\85b57d7791c6ca66388316d2f17fc0bc.exe","uid":"00013895-00002808","icon":"$2a"},{"pid":2068,"ppid":2808,"name":"SVCHOST.exe","command_line":"\"%TEMP%\\w7e89.tmp\"","sha256":"b6cf214ecb4471cac7f8331074f0c9fde8bfc264b65557db72e1c604a692eda6","normalized_path":"%TEMP%\\SVCHOST.exe","parent_uid":"00013895-00002808","uid":"00014079-00002068"},{"pid":1468,"ppid":2068,"name":"explorer.exe","command_line":"","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00014079-00002068","uid":"00014225-00001468"},{"pid":4044,"ppid":1468,"name":"sysprep.exe","command_line":"\"\"%TEMP%\\w7e89.tmp\"\" \"%WINDIR%\\system32\" \"*n/a\"","sha256":"de3dfb3617b3e3fabb9f12088e7d2019510915e0ae2397e7f96fe2575cfbf8fc","normalized_path":"%WINDIR%\\System32\\sysprep\\sysprep.exe","parent_uid":"00014225-00001468","uid":"00014242-00004044"},{"pid":3944,"ppid":4044,"name":"w7e89.tmp","command_line":"*n/a","sha256":"591eb8ce448ab95b28a043943bd9de91489b5ebb1ef4a7b2646742b635fa93f2","normalized_path":"%TEMP%\\w7e89.tmp","parent_uid":"00014242-00004044","uid":"00014265-00003944"},{"pid":2260,"ppid":3944,"name":"cmd.exe","command_line":"cmd /c %TEMP%\\~RF833B.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014265-00003944","uid":"00016451-00002260"},{"pid":2932,"ppid":2808,"name":"cmd.exe","command_line":"cmd /c %TEMP%\\\\ud.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013895-00002808","uid":"00014599-00002932"}],"all_imported_dlls":["unattend.dll","cfgmgr32.dll","devobj.dll","KernelBase.dll","usp10.dll","advapi32.dll","rpcrt4.dll","ole32.dll","imageres.dll","imm32.dll","msctf.dll","sechost.dll","shell32.dll","setupapi.dll","comctl32.dll","dbghelp.dll","kernel32.dll","uxtheme.dll","dwmapi.dll","apphelp.dll","comsvcs.dll","wdscore.dll","CRYPTBASE.dll","winbrand.dll","gdi32.dll","msvcrt.dll","sfc_os.dll","ActionQueue.dll","oleaut32.dll","ntdll.dll","user32.dll","mtxoci.dll","sfc.dll","shlwapi.dll","rpcss.dll","lpk.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SVCHOST.exe","sha256":"b6cf214ecb4471cac7f8331074f0c9fde8bfc264b65557db72e1c604a692eda6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"w7e2C76.tmp","sha256":"7297b36616f2674d5fde16abbeabd0174d2349f532b0e3a49ccb2057bcb1d0e4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"w7e89.tmp","sha256":"591eb8ce448ab95b28a043943bd9de91489b5ebb1ef4a7b2646742b635fa93f2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"~ER354E.tmp","sha256":"353a1288b1f8866af17cd7dffb8b202860f03da8d42e6a76df7b5212b3294632","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"ud.bat","sha256":"909a5ac8e80396a3dfb6b29060afae2b223457815c878569ec0794cf49435fe0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"~RF833B.bat","sha256":"3cc502dea997a5a7c33a2d89d68f45ccd8c7538f67060d8753b21db0ad8dd8ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"diagerr.xml","sha256":"06bbfa22315b9c8c4a16b49d98c055c782792f155826b4d3482543fefa10c0db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"diagwrn.xml","sha256":"6c06bf950d0fe3476e020cd363ec0c8c9d4ee0fc89a24c50780c44e6453995c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"setupact.log","sha256":"ae8d04cc3d2350fb83d3d1b985ab9f78ad27159212637cf98210e634c500d2b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"setuperr.log","sha256":"d754c4cbea80805c46e37245aa51d8df0e046b85cb4cd05a1cac3a0789ae3d9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]}],"files_written":[{"path":"%TEMP%\\SVCHOST.exe","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\sysprep\\sysprep.exe","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\sysprep\\en-US\\sysprep.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setuperr.log","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\diagerr.xml","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\diagwrn.xml","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setuplog.cfg","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setupact.log","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%TEMP%\\w7e89.tmp","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\sysprep","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%TEMP%\\~ER354E.tmp","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%TEMP%\\ud.bat","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\msipnathlp.dll","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%TEMP%\\~RF833B.tmp","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"C:\\Users\\mxQ0sCf","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%TEMP%\\~RF833B.bat","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%PROGRAMFILES%\\Microsoft Games\\Solitaire\\Solitaire.exe","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%WINDIR%\\System32\\msconfig.exe","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\dcd5734867e97.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\cbc036d6fdb69fb5.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\1f34f1a500af6119.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b464ae5c58e59aac.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b3f13480c2785ae.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\6f4c76f1482ef052.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\337ed59af273c758.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\bcb504227031d15c.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b91050d8b077a4e8.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]},{"name":"Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5b1e9b067ca3e15c2232e883"}]}]}},"report_ids":{"sandbox_job_ids":["5b1e9b067ca3e15c2232e883"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware Sample 2e500b2f160f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2e500b2f160f…. Malware family: Malware. Threat score 100/100. 18/28 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2e500b2f160f927b1140fb105b83300ca21762c21bb6195c44e8dc613f7d7b12"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 2e500b2f160f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2e500b2f160f…. Malware family: Malware. Threat score 100/100. 18/28 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2e500b2f160f927b1140fb105b83300ca21762c21bb6195c44e8dc613f7d7b12"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 2e500b2f160f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2e500b2f160f…. Malware family: Malware. Threat score 100/100. 18/28 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]