26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Packed.7zip Sample 2fcffd3914b2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2fcffd3914b2…. Malware family: Packed.7zip. Threat score 100/100. 14/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2fcffd3914b2555cd521d7c2d3c43e8e8af300f9ee161d3ae0c028206f55775b","keywords":["Malicious","Packed.7zip","malware analysis","sandbox report","threat intelligence","2fcffd3914b2555cd521d7c2d3c43e8e8af300f9ee161d3ae0c028206f55775b"],"about":{"@type":"SoftwareApplication","name":"MultiverseX.exe","applicationCategory":["peexe","executable"],"identifier":"2fcffd3914b2555cd521d7c2d3c43e8e8af300f9ee161d3ae0c028206f55775b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Packed.7zip","antivirusDetections":{"malicious":14,"total":25},"behavioralIndicators":{"malicious":8,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4f4,"MultiverseX.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004508) "MultiverseX.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000002d00000005000000050000000000000000000000281bcf020000000032000000080000000000cd0298f89300d028ce02d028ce02020000002400000005000000080000000000cd02b8f89300460000000000a402feffffff7300a4026002cd02d007a402100000005080cf026f0000000000a402200000007500a402c001a402140ca4022000000078f89300b4c74100d8f1cd0298f1cd0211000000000000001700000070f893003bd9410060384300acf8930084c641000200000074c641009f186253110000000c644200170000000000000080f893000200000054f9930050954100a33eb353feffffff74c641009ec94100c8f89300c0f89300 (UID: 00000000-00004508)28:T128e,"MultiverseX.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004508) "MultiverseX.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004508)29:Tb4e2,Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "MultiverseX.exe") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetProcessPreferredUILanguages"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "MultiverseX.exe") Found reference to API (Indicator: "FlsAlloc"; File: "MultiverseX.exe") Found reference to API (Indicator: "FlsFree"; File: "MultiverseX.exe") Found reference to API (Indicator: "FlsGetValue"; File: "MultiverseX.exe") Found reference to API (Indicator: "FlsSetValue"; File: "MultiverseX.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "MultiverseX.exe") Found reference to API (Indicator: "CompareStringEx"; File: "MultiverseX.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "MultiverseX.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetTickCount"; File: "MultiverseX.exe") Found reference to API (Indicator: "lstrlenW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "MultiverseX.exe") Found reference to API (Indicator: "CloseHandle"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetLastError"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetLastError"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "MultiverseX.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "MultiverseX.exe") Found reference to API (Indicator: "ResumeThread"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateProcessW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateJobObjectW"; File: "MultiverseX.exe") Found reference to API (Indicator: "AssignProcessToJobObject"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetInformationJobObject"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetProcAddress"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "MultiverseX.exe") Found reference to API (Indicator: "Sleep"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateThread"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetLocalTime"; File: "MultiverseX.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetStdHandle"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "MultiverseX.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "MultiverseX.exe") Found reference to API (Indicator: "CompareFileTime"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "MultiverseX.exe") Found reference to API (Indicator: "DeleteFileW"; File: "MultiverseX.exe") Found reference to API (Indicator: "FindClose"; File: "MultiverseX.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "MultiverseX.exe") Found reference to API (Indicator: "FindNextFileW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "MultiverseX.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "MultiverseX.exe") Found reference to API (Indicator: "WriteFile"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetTempPathW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "MultiverseX.exe") Found reference to API (Indicator: "LoadResource"; File: "MultiverseX.exe") Found reference to API (Indicator: "LockResource"; File: "MultiverseX.exe") Found reference to API (Indicator: "SizeofResource"; File: "MultiverseX.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "MultiverseX.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "MultiverseX.exe") Found reference to API (Indicator: "GlobalFree"; File: "MultiverseX.exe") Found reference to API (Indicator: "MulDiv"; File: "MultiverseX.exe") Found reference to API (Indicator: "lstrcmpW"; File: "MultiverseX.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "MultiverseX.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "MultiverseX.exe") Found reference to API (Indicator: "lstrlenA"; File: "MultiverseX.exe") Found reference to API (Indicator: "FindResourceExA"; File: "MultiverseX.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "MultiverseX.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetThreadLocale"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateFileA"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateFileW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetVersionExW"; File: "MultiverseX.exe") Found reference to API (Indicator: "VirtualProtect"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "MultiverseX.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "MultiverseX.exe") Found reference to API (Indicator: "FreeLibrary"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetProcessWorkingSetSize"; File: "MultiverseX.exe") Found reference to API (Indicator: "FreeConsole"; File: "MultiverseX.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetEvent"; File: "MultiverseX.exe") Found reference to API (Indicator: "ResetEvent"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateEventW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "MultiverseX.exe") Found reference to API (Indicator: "TerminateThread"; File: "MultiverseX.exe") Found reference to API (Indicator: "SuspendThread"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "MultiverseX.exe") Found reference to API (Indicator: "LocalFree"; File: "MultiverseX.exe") Found reference to API (Indicator: "FormatMessageW"; File: "MultiverseX.exe") Found reference to API (Indicator: "lstrcpyW"; File: "MultiverseX.exe") Found reference to API (Indicator: "IsBadReadPtr"; File: "MultiverseX.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "MultiverseX.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "MultiverseX.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "MultiverseX.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "MultiverseX.exe") Found reference to API (Indicator: "VirtualFree"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetFileSize"; File: "MultiverseX.exe") Found reference to API (Indicator: "ReadFile"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetFilePointer"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetFileTime"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "MultiverseX.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "MultiverseX.exe") Found reference to API (Indicator: "RtlUnwind"; File: "MultiverseX.exe") Found reference to API (Indicator: "RaiseException"; File: "MultiverseX.exe") Found reference to API (Indicator: "EncodePointer"; File: "MultiverseX.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "MultiverseX.exe") Found reference to API (Indicator: "TlsAlloc"; File: "MultiverseX.exe") Found reference to API (Indicator: "TlsGetValue"; File: "MultiverseX.exe") Found reference to API (Indicator: "TlsSetValue"; File: "MultiverseX.exe") Found reference to API (Indicator: "TlsFree"; File: "MultiverseX.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "MultiverseX.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "MultiverseX.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "MultiverseX.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "MultiverseX.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "MultiverseX.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "MultiverseX.exe") Found reference to API (Indicator: "TerminateProcess"; File: "MultiverseX.exe") Found reference to API (Indicator: "ShowWindow"; File: "MultiverseX.exe") Found reference to API (Indicator: "BringWindowToTop"; File: "MultiverseX.exe") Found reference to API (Indicator: "wsprintfA"; File: "MultiverseX.exe") Found reference to API (Indicator: "wsprintfW"; File: "MultiverseX.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "MultiverseX.exe") Found reference to API (Indicator: "DestroyWindow"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetWindowPos"; File: "MultiverseX.exe") Found reference to API (Indicator: "CharUpperW"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetTimer"; File: "MultiverseX.exe") Found reference to API (Indicator: "KillTimer"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetMenu"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetWindowDC"; File: "MultiverseX.exe") Found reference to API (Indicator: "ReleaseDC"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetWindowRect"; File: "MultiverseX.exe") Found reference to API (Indicator: "ScreenToClient"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetSysColor"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetParent"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetClassNameA"; File: "MultiverseX.exe") Found reference to API (Indicator: "CopyImage"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetKeyState"; File: "MultiverseX.exe") Found reference to API (Indicator: "MessageBoxA"; File: "MultiverseX.exe") Found reference to API (Indicator: "wvsprintfW"; File: "MultiverseX.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "MultiverseX.exe") Found reference to API (Indicator: "IsWindow"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetFocus"; File: "MultiverseX.exe") Found reference to API (Indicator: "EnableWindow"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "MultiverseX.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetDC"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetClientRect"; File: "MultiverseX.exe") Found reference to API (Indicator: "MessageBeep"; File: "MultiverseX.exe") Found reference to API (Indicator: "ClientToScreen"; File: "MultiverseX.exe") Found reference to API (Indicator: "PtInRect"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetWindow"; File: "MultiverseX.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "MultiverseX.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "MultiverseX.exe") Found reference to API (Indicator: "LoadIconW"; File: "MultiverseX.exe") Found reference to API (Indicator: "LoadImageW"; File: "MultiverseX.exe") Found reference to API (Indicator: "DrawIconEx"; File: "MultiverseX.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "MultiverseX.exe") Found reference to API (Indicator: "DeleteDC"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetCurrentObject"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "MultiverseX.exe") Found reference to API (Indicator: "SelectObject"; File: "MultiverseX.exe") Found reference to API (Indicator: "StretchBlt"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetStretchBltMode"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetObjectW"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "MultiverseX.exe") Found reference to API (Indicator: "DeleteObject"; File: "MultiverseX.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "MultiverseX.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "MultiverseX.exe") Found reference to API (Indicator: "FreeSid"; File: "MultiverseX.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "MultiverseX.exe") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "MultiverseX.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "MultiverseX.exe") Found reference to API (Indicator: "SHGetMalloc"; File: "MultiverseX.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "MultiverseX.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "MultiverseX.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "MultiverseX.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "MultiverseX.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "MultiverseX.exe") Found reference to API (Indicator: "CoInitialize"; File: "MultiverseX.exe") Found reference to API (Indicator: "ExitThread"; File: "MultiverseX.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "MultiverseX.exe") Found reference to API (Indicator: "ExitProcess"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetACP"; File: "MultiverseX.exe") Found reference to API (Indicator: "HeapAlloc"; File: "MultiverseX.exe") Found reference to API (Indicator: "HeapFree"; File: "MultiverseX.exe") Found reference to API (Indicator: "CompareStringW"; File: "MultiverseX.exe") Found reference to API (Indicator: "LCMapStringW"; File: "MultiverseX.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetFileType"; File: "MultiverseX.exe") Found reference to API (Indicator: "FindFirstFileExA"; File: "MultiverseX.exe") Found reference to API (Indicator: "FindNextFileA"; File: "MultiverseX.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetOEMCP"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetCPInfo"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "MultiverseX.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetStdHandle"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "MultiverseX.exe") Found reference to API (Indicator: "HeapSize"; File: "MultiverseX.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "MultiverseX.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "MultiverseX.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "MultiverseX.exe") Found reference to API (Indicator: "DecodePointer"; File: "MultiverseX.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "MultiverseX.exe") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetProcessPreferredUILanguages"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateJobObjectW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "AssignProcessToJobObject"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetInformationJobObject"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetThreadLocale"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetProcessWorkingSetSize"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "BringWindowToTop"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "wvsprintfW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentObject"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetStretchBltMode"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SHGetMalloc"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp")2a:T6af,"MultiverseX.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")2b:Ta96,"MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "MULTIVERSEX.EXE"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "MultiverseX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")2c:T467,Heuristic match: "xL.cn" Heuristic match: "`.biZ" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertTrustedRootG4.crt0C" Pattern match: "crl3.digicert.com/DigiCertTrustedRootG4.crl0" Pattern match: "crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" Pattern match: "crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=" Pattern match: "http://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" Pattern match: "crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0" Pattern match: "http://ocsp.digicert.com0X" Pattern match: "cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "http://www.w3.org/2001/XMLSchema-instance"2d:T9e5,Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "MultiverseX.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "MultiverseX.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "MultiverseX.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "MultiverseX.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "MultiverseX.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004508.00000000.66606.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004508.00000000.66606.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004508.00000000.66606.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004508.00000000.66606.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004508.00000000.66606.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004508.00000000.66606.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004508.00000000.66606.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004508.00000000.66606.02CD0000.00000004.mdmp")2e:T5ca,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "MultiverseX.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "MultiverseX.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "MultiverseX.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "MultiverseX.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "MultiverseX.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "MultiverseX.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp")2f:T5ca,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "MultiverseX.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "MultiverseX.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "MultiverseX.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "MultiverseX.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "MultiverseX.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "MultiverseX.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004508.00000000.66606.00426000.00000002.mdmp")30:T579,"cmd.exe" called "LoadResource with parameter {'hModule': '5898241', 'hResInfo': '5899152'}" (UID: 00000000-00002928) "Recreation.pif" called "LoadResource with parameter {'hModule': '1908408320', 'hResInfo': '1908584968'}" (UID: 00000000-00001708) "Recreation.pif" called "LoadResource with parameter {'hModule': '11665408', 'hResInfo': '12539288'}" (UID: 00000000-00001708) "Recreation.pif" called "LoadResource with parameter {'hModule': '11665408', 'hResInfo': '12539064'}" (UID: 00000000-00001708) "Recreation.pif" called "LoadResource with parameter {'hModule': '11665408', 'hResInfo': '12539320'}" (UID: 00000000-00001708) "Recreation.pif" called "LoadResource with parameter {'hModule': '11665408', 'hResInfo': '12539128'}" (UID: 00000000-00001708) "Recreation.pif" called "LoadResource with parameter {'hModule': '11665408', 'hResInfo': '12539304'}" (UID: 00000000-00001708) "Recreation.pif" called "LoadResource with parameter {'hModule': '11665408', 'hResInfo': '12539112'}" (UID: 00000000-00001708) "Recreation.pif" called "LoadResource with parameter {'hModule': '11665408', 'hResInfo': '12539080'}" (UID: 00000000-00001708) "Recreation.pif" called "LoadResource with parameter {'hModule': '11665408', 'hResInfo': '12539336'}" (UID: 00000000-00001708) "Recreation.pif" called "LoadResource with parameter {'hModule': '11665408', 'hResInfo': '12539096'}" (UID: 00000000-00001708)31:T5a3,file/memory contains long string with (Indicator: "set "; File: "Until") Found string "Set BWLJHbsXHGnMaeIZsNibTeOatcKiidUixrrgNWBlfspyc=v" (Indicator: "set "; File: "Until") Found string "Set CqyarDJiCinuAhrVejhzQmOblHebgstumJYwmrVDwXncbGtEd=p" (Indicator: "set "; File: "Until") Found string "Set iBbPFfDLaQTeFaLmEaVzILnSgmWlYHCOKDxy=d" (Indicator: "set "; File: "Until") Found string "Set CkSzXtUHNxoGeigooVzDZwFIWktUQxMCwdbtsTXweQUWQhj=g" (Indicator: "set "; File: "Until") Found string "Set mooQvDbQYcrSZmnBcklhsPNynuTCtNtBlOufgsVpW=x" (Indicator: "set "; File: "Until") Found string "Set kWHUhFyxIrtsItrPXJZJQPzoocQVNKcAzlb=c" (Indicator: "set "; File: "Until") Found string "Set TGwfQEMfzGasAtNtwYeYEYcBuJbrWHQqtt=a" (Indicator: "set "; File: "Until") Found string "Set hvwDjIlbAVQNcUAUFazaeijqAVPNKrzYneoERk=q" (Indicator: "set "; File: "Until") Found string "Set JWvbywaJIvrDaSlWHSnzmizzGagBDrpz=y" (Indicator: "set "; File: "Until") Found string "Set TjyEBvHDxamWCqTXMXbeRqWjCgSQfjiNBCmGdntOLNRKgsQ=h" (Indicator: "set "; File: "Until") Found string "Set vPnETFbXXnEOSpZscNvvKXDwLlUTLEPlEXRGRiDfaLbT=e" (Indicator: "set "; File: "Until") Found string "Set tvKtiMFAXZxdRXbsxSUoCAKhPREDINtZtfitkfwHLGyAuL=s" (Indicator: "set "; File: "Until") Found string "Set qPIrcolgoelEONfDmNZZizThaSOCVvuqO=i" (Indicator: "set "; File: "Until") Found string "Set AptWKOKqlJTmsqGxnnBCSHeffwquhQTU=l" (Indicator: "set "; File: "Until")32:T498,"MultiverseX.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /k cmd < Until & exit" - (UID: 00000000-00003204) "cmd.exe" called "CreateProcessW" with parameter "tasklist" - (UID: 00000000-00002928) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"" - (UID: 00000000-00002928) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "wrsa.exe"" - (UID: 00000000-00002928) "cmd.exe" called "CreateProcessW" with parameter "cmd /c mkdir 27905" - (UID: 00000000-00002928) "cmd.exe" called "CreateProcessW" with parameter "cmd /c copy /b Colon + Hiring + Dictionary + Recall 27905\Recreation.pif" - (UID: 00000000-00002928) "cmd.exe" called "CreateProcessW" with parameter "cmd /c copy /b Configuring + Treasure 27905\B" - (UID: 00000000-00002928) "cmd.exe" called "CreateProcessW" with parameter "27905\Recreation.pif 27905\B" - (UID: 00000000-00002928) "cmd.exe" called "CreateProcessW" with parameter "ping -n 5 localhost" - (UID: 00000000-00002928) "Recreation.pif" called "CreateProcessW" with parameter "%TEMP%\7ZipSfx.000\27905\jsc.exe" - (UID: 00000000-00001708)33:T1d64,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000000.66544.00610000.00000004.mdmp "SfxFolder07=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startupr}.]Fo" (Indicator: "sfxfolder07=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startupr}.]fo") in Source: 00000000-00001708.00000000.66544.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00610000.00000004.mdmp "SfxFolder30=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "sfxfolder30=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000000.66544.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00620000.00000004.mdmp "7zSfxFolder07=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder07=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000000.66544.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00620000.00000004.mdmp "7zSfxFolder24=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder24=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000000.66544.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00620000.00000004.mdmp "7zSfxFolder29=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder29=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000000.66544.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00620000.00000004.mdmp "7zSfxFolder30=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder30=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000000.66544.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00620000.00000004.mdmp "SfxFolder07=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "sfxfolder07=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000000.66544.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00620000.00000004.mdmp "SfxFolder24=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "sfxfolder24=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000000.66544.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00620000.00000004.mdmp "SfxFolder29=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "sfxfolder29=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000000.66544.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00610000.00000004.mdmp 00000000-00001708.00000001.68069.00620000.00000004.mdmp "Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000001.68069.00610000.00000004.mdmp "fxFolder07=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "fxfolder07=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000001.68069.00620000.00000004.mdmp "fxFolder24=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "fxfolder24=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000001.68069.00620000.00000004.mdmp "fxFolder29=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "fxfolder29=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000001.68069.00620000.00000004.mdmp "fxFolder30=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "fxfolder30=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000001.68069.00620000.00000004.mdmp "zSfxFolder07=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "zsfxfolder07=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000001.68069.00620000.00000004.mdmp "zSfxFolder24=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "zsfxfolder24=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000001.68069.00620000.00000004.mdmp "zSfxFolder29=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "zsfxfolder29=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000001.68069.00620000.00000004.mdmp "zSfxFolder30=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "zsfxfolder30=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001708.00000001.68069.00620000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003204.00000000.65554.00270000.00000004.mdmp 00000000-00003204.00000001.66410.00270000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003204.00000000.65554.00270000.00000004.mdmp 00000000-00003204.00000001.66410.00270000.00000004.mdmp "7zSfxFolder07=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder07=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003204.00000000.65554.00270000.00000004.mdmp 00000000-00003204.00000001.66410.00270000.00000004.mdmp "7zSfxFolder24=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder24=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003204.00000000.65554.00270000.00000004.mdmp 00000000-00003204.00000001.66410.00270000.00000004.mdmp "7zSfxFolder29=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder29=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003204.00000000.65554.00270000.00000004.mdmp 00000000-00003204.00000001.66410.00270000.00000004.mdmp "7zSfxFolder30=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder30=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003204.00000000.65554.00270000.00000004.mdmp 00000000-00003204.00000001.66410.00270000.00000004.mdmp34:T51c,"MultiverseX.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "MultiverseX.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "tasklist.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "tasklist.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "findstr.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "findstr.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Recreation.pif" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "Recreation.pif" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "PING.EXE" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "PING.EXE" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]35:Tcb7,"MultiverseX.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "MultiverseX.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "MultiverseX.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "MultiverseX.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "MultiverseX.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "MultiverseX.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "MultiverseX.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "MultiverseX.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "MultiverseX.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "MultiverseX.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "MultiverseX.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "MultiverseX.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "MultiverseX.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "MultiverseX.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "MultiverseX.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "MultiverseX.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "MultiverseX.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "MultiverseX.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "MultiverseX.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "MultiverseX.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "MultiverseX.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "MultiverseX.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "MultiverseX.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "MultiverseX.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "MultiverseX.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS")36:T1e57,Process "cmd.exe" (UID: 00000000-00001728) was launched with new environment variables: "7zSfxFolder20="%WINDIR%\Fonts", 7zSfxFolder21="%APPDATA%\Microsoft\Windows\Templates", SfxFolder39="%USERPROFILE%\Pictures", SfxFolder38="C:\Program Files", SfxFolder37="%WINDIR%\system32", MyDocs="%USERPROFILE%\Documents", SfxFolder36="C:\Windows", SfxFolder35="C:\ProgramData", SfxFolder34="%LOCALAPPDATA%\Microsoft\Windows\History", SfxFolder33="%APPDATA%\Microsoft\Windows\Cookies", SfxFolder32="%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files", SfxFolder31="%USERPROFILE%\Favorites", SfxFolder30="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup", 7zSfxFolder28="%USERPROFILE%\AppData\Local", 7zSfxFolder29="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup", 7zSfxFolder26="%USERPROFILE%\AppData\Roaming", 7zSfxFolder27="%APPDATA%\Microsoft\Windows\Printer Shortcuts", 7zSfxVarSystemLanguage="1033", 7zSfxFolder24="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup", 7zSfxFolder25="%PUBLIC%\Desktop", 7zSfxFolder22="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu", 7zSfxFolder23="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs", SfxVarSystemLanguage="1033", SfxString10="Could not write SFX configuration.", SfxString12="Could not create folder "%s".", SfxString11="Error in line %d of configuration data:", SfxVarSystemPlatform="x86", SfxFolder48="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Administrative Tools", SfxString18="7-Zip: CRC error.", SfxFolder47="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools", SfxString17="7-Zip: Unsupported method.", SfxFolder46="%PUBLIC%\Documents", SfxFolder45="%ALLUSERSPROFILE%\Microsoft\Windows\Templates", SfxString19="7-Zip: Data error.", SfxFolder44="%PROGRAMFILES%\Common Files", SfxString14="Could not find command for "%s".", SfxFolder43="%PROGRAMFILES%\Common Files", SfxString13="Could not delete file or folder "%s".", SfxFolder42="C:\Program Files", SfxString16="Error during execution "%s".", SfxFolder41="%WINDIR%\system32", SfxString15="Could not find "setup.exe".", SfxFolder40="C:\Users\%OSUSER%", 7zSfxFolder19="%APPDATA%\Microsoft\Windows\Network Shortcuts", SfxVarCmdLine0=""C:\MultiverseX.exe"", 7zSfxFolder16="%USERPROFILE%\Desktop", 7zSfxFolder13="%USERPROFILE%\Music", 7zSfxFolder14="%USERPROFILE%\Videos", 7zSfxFolder11="%APPDATA%\Microsoft\Windows\Start Menu", 7zSfxFolder42="C:\Program Files", 7zSfxFolder43="%PROGRAMFILES%\Common Files", 7zSfxVarCmdLine0=""C:\MultiverseX.exe"", 7zSfxFolder40="C:\Users\%OSUSER%", 7zSfxFolder41="%WINDIR%\system32", SfxFolder19="%APPDATA%\Microsoft\Windows\Network Shortcuts", SfxFolder16="%USERPROFILE%\Desktop", SfxFolder14="%USERPROFILE%\Videos", SfxFolder13="%USERPROFILE%\Music", SfxFolder11="%APPDATA%\Microsoft\Windows\Start Menu", Jc="<", 7zSfxFolder48="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Administrative Tools", 7zSfxFolder46="%PUBLIC%\Documents", 7zSfxFolder47="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools", 7zSfxFolder44="%PROGRAMFILES%\Common Files", 7zSfxFolder45="%ALLUSERSPROFILE%\Microsoft\Windows\Templates", 7zSfxFolder31="%USERPROFILE%\Favorites", 7zSfxFolder32="%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files", 7zSfxFolder30="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup", MyDocuments="%USERPROFILE%\Documents", SfxFolder29="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup", SfxFolder28="%USERPROFILE%\AppData\Local", SfxFolder27="%APPDATA%\Microsoft\Windows\Printer Shortcuts", SfxFolder26="%USERPROFILE%\AppData\Roaming", SfxFolder25="%PUBLIC%\Desktop", SfxFolder24="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup", SfxFolder23="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs", SfxFolder22="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu", SfxFolder21="%APPDATA%\Microsoft\Windows\Templates", SfxFolder20="%WINDIR%\Fonts", 7zSfxFolder39="%USERPROFILE%\Pictures", 7zSfxFolder37="%WINDIR%\system32", 7zSfxFolder38="C:\Program Files", 7zSfxFolder35="C:\ProgramData", 7zSfxFolder36="C:\Windows", 7zSfxFolder33="%APPDATA%\Microsoft\Windows\Cookies", 7zSfxFolder34="%LOCALAPPDATA%\Microsoft\Windows\History", SfxString43="Insufficient physical memory.", SfxString42="Not enough free space for extracting.", SfxString45="Preparing...", SfxString44="Enter password:", CommonDocuments="%PUBLIC%\Documents", SfxString41=": warning", SfxString40="7z SFX: warning", UserDesktop="%USERPROFILE%\Desktop", SfxString6="Could not get SFX filename.", SfxString7="Could not open archive file "%s".", SfxString8="Non 7z archive.", SfxString9="Could not read SFX configuration or configuration not found.", Procedure="/", 7zSfxFolder53="%PUBLIC%\Music", 7zSfxFolder54="%PUBLIC%\Pictures", SfxFolder09="%APPDATA%\Microsoft\Windows\SendTo", SfxFolder08="%APPDATA%\Microsoft\Windows\Recent", SfxFolder07="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup", SfxFolder06="%USERPROFILE%\Favorites", SfxFolder05="%USERPROFILE%\Documents", SfxFolder02="%APPDATA%\Microsoft\Windows\Start Menu\Programs", SfxString1="SFX module - Copyright (c) 2005-2016 Oleg Scherbakov", SfxFolder00="%USERPROFILE%\Desktop", SfxString2="7z SFX", SfxString3="7z SFX: error", SfxString4=": error", 7zSfxVarModulePlatform="x86", SfxString5="Extracting", 7zSfxFolder59="%LOCALAPPDATA%\Microsoft\Windows\Burn\Burn", 7zSfxFolder55="%PUBLIC%\Videos", 7zSfxFolder56="%WINDIR%\resources", SfxString21="Extraction path", SfxString20="7-Zip: Internal error code %u.", SfxString23="Really cancel the installation?", SfxString22="Extraction path:", SfxFolder59="%LOCALAPPDATA%\Microsoft\Windows\Burn\Burn", SfxString29="s", SfxString28="No", SfxFolder56="%WINDIR%\resources", SfxFolder55="%PUBLIC%\Videos", SfxString25="OK", SfxFolder54="%PUBLIC%\Pictures", SfxString24="No "HelpText" in the configuration file.", SfxFolder53="%PUBLIC%\Music", SfxString27="Yes", SfxString26="Cancel", 7zSfxFolder08="%APPDATA%\Microsoft\Windows\Recent", 7zSfxFolder09="%APPDATA%\Microsoft\Windows\SendTo", 7zSfxFolder06="%USERPROFILE%\Favorites", 7zSfxFolder07="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup", 7zSfxFolder05="%USERPROFILE%\Documents", 7zSfxFolder02="%APPDATA%\Microsoft\Windows\Start Menu\Programs", 7zSfxFolder00="%USERPROFILE%\Desktop", SfxString32="Error in command line:", Addressed="x", SfxString31="Could not overwrite file "%s".", SfxString34="7-Zip: Extraction error.", SfxString33="7-Zip: Internal error code 0x%08X.", 7zSfxVarSystemPlatform="x86", SfxString30="Could not create file "%s".", SfxVarModulePlatform="x86", SfxString36="Next", SfxString35="Back", SfxString38="Cancel", SfxString37="Finish", Regard="m", CommonDesktop="%PUBLIC%\Desktop", Pet="d"" Process "cmd.exe" (UID: 00000000-00002928) was launched with new environment variables: "PROMPT="$P$G"" Process "tasklist.exe" (UID: 00000000-00003852) was launched with new environment variables: "tvKtiMFAXZxdRXbsxSUoCAKhPREDINtZtfitkfwHLGyAuL="s", CkSzXtUHNxoGeigooVzDZwFIWktUQxMCwdbtsTXweQUWQhj="g", qPIrcolgoelEONfDmNZZizThaSOCVvuqO="i", JWvbywaJIvrDaSlWHSnzmizzGagBDrpz="y", TGwfQEMfzGasAtNtwYeYEYcBuJbrWHQqtt="a", vPnETFbXXnEOSpZscNvvKXDwLlUTLEPlEXRGRiDfaLbT="e", hvwDjIlbAVQNcUAUFazaeijqAVPNKrzYneoERk="q", OUgpzpjQHeOsLnNVttfnMFitEuCWj="Recreation.pif", TjyEBvHDxamWCqTXMXbeRqWjCgSQfjiNBCmGdntOLNRKgsQ="h", kWHUhFyxIrtsItrPXJZJQPzoocQVNKcAzlb="c", iBbPFfDLaQTeFaLmEaVzILnSgmWlYHCOKDxy="d", mooQvDbQYcrSZmnBcklhsPNynuTCtNtBlOufgsVpW="x", CqyarDJiCinuAhrVejhzQmOblHebgstumJYwmrVDwXncbGtEd="p", BWLJHbsXHGnMaeIZsNibTeOatcKiidUixrrgNWBlfspyc="v", AptWKOKqlJTmsqGxnnBCSHeffwquhQTU="l"" Process "cmd.exe" (UID: 00000000-00003880) was launched with new environment variables: "RmCFuaoGTnYWPyoTAkSnmABVZIGQEknGpIHfRL="27905""37:T567,"Recreation.pif" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\7ZipSfx.000\27905\Recreation.pif]- [targetUID: 00000000-00003204] "jsc.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\7ZipSfx.000\27905\jsc.exe]- [targetUID: 00000000-00001708] "B" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\7ZipSfx.000\27905\B]- [targetUID: 00000000-00003204] "Configuring" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\7ZipSfx.000\Configuring]- [targetUID: 00000000-00003204] "Hiring" has type "data"- Location: [%TEMP%\7ZipSfx.000\Hiring]- [targetUID: 00000000-00003204] "Recall" has type "data"- Location: [%TEMP%\7ZipSfx.000\Recall]- [targetUID: 00000000-00003204] "Colon" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\7ZipSfx.000\Colon]- [targetUID: 00000000-00003204] "Dictionary" has type "data"- Location: [%TEMP%\7ZipSfx.000\Dictionary]- [targetUID: 00000000-00003204] "Until" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\7ZipSfx.000\Until]- [targetUID: 00000000-00003204] "Treasure" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\7ZipSfx.000\Treasure]- [targetUID: 00000000-00003204]38:T968,"MultiverseX.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\cmd.* (UID: 00000000-00003204) "MultiverseX.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\cmd.* (UID: 00000000-00003204) "MultiverseX.exe" called "FindNextFileW" with parameter cmd.exe (UID: 00000000-00003204) "MultiverseX.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Colon (UID: 00000000-00003204) "MultiverseX.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Configuring (UID: 00000000-00003204) "MultiverseX.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Dictionary (UID: 00000000-00003204) "MultiverseX.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Hiring (UID: 00000000-00003204) "MultiverseX.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Recall (UID: 00000000-00003204) "MultiverseX.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Treasure (UID: 00000000-00003204) "MultiverseX.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Until (UID: 00000000-00003204) "MultiverseX.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000 (UID: 00000000-00003204) "MultiverseX.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\* (UID: 00000000-00003204) "MultiverseX.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003204) "MultiverseX.exe" called "FindNextFileW" with parameter 27905 (UID: 00000000-00003204) "MultiverseX.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\27905\* (UID: 00000000-00003204) "MultiverseX.exe" called "FindNextFileW" with parameter B (UID: 00000000-00003204) "MultiverseX.exe" called "FindNextFileW" with parameter Recreation.pif (UID: 00000000-00003204) "cmd.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00002928) "cmd.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002928) "cmd.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00002928) "cmd.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002928) "cmd.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00002928) "cmd.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000 (UID: 00000000-00002928) "cmd.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\*.* (UID: 00000000-00002928)39:T408,Found reference to API "$HeaterMedicationUpgrading = DllCall('ntdll.dll', 'long', 'NtQueryInformationProcess', 'handle', $GroundsHayesMastercard, 'ulong', 0, 'struct*', $EXCELLENTLET, 'ulong', DllStructGetSize($EXCELLENTLET), 'ulong*', 0)" (Indicator: "NtQueryInformationProcess"; File: "Configuring") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00001708.00000001.68069.00BBD000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001708.00000001.68069.00BBD000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001708.00000001.68069.00BBD000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001708.00000001.68069.00BBD000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001708.00000001.68069.00BBD000.00000002.mdmp")3a:T4b4,"MultiverseX.exe" wrote 27648 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Colon": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "cmd.exe" wrote 512 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\27905\Recreation.pif": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Recreation.pif" wrote 46632 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\27905\jsc.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...3b:T576,"Recreation.pif" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter System" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter smss.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter services.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter lsm.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter audiodg.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter spoolsv.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter taskhost.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00001708) "Recreation.pif" called "Process32NextW with parameter explorer.exe" (UID: 00000000-00001708)3c:T8b4,"Recreation.pif wrote PE header bytes ("4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000504500004c010300450163650000000000000000e00002000b010800001401000010000000000000ae330100002000000040010000000600002000000002000004000000000000000400000000000000008001000002000000000000020040850000100000100000000010000010000000000000100000000000000000000000583301005300000000400100f70d000000000000000000000000000000000000006001000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002e74657874000000b4130100002000000014010000020000000000000000000000000000200000602e72737263000000f70d000000400100000e000000160100000000000000000000000000400000402e72656c6f6300000c00000000600100000200000024010000000000000000000000000040000042000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\27905\jsc.exe" which might be an injection preparation attempt ...3d:T48f,Spawned process "MultiverseX.exe" (UID: 00000000-00003204) Spawned process "cmd.exe" with commandline "/k cmd < Until & exit" (UID: 00000000-00001728) Spawned process "cmd.exe" (UID: 00000000-00002928) Spawned process "tasklist.exe" (UID: 00000000-00003852) Spawned process "findstr.exe" with commandline "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"" (UID: 00000000-00003584) Spawned process "tasklist.exe" (UID: 00000000-00002856) Spawned process "findstr.exe" with commandline "findstr /I "wrsa.exe"" (UID: 00000000-00002444) Spawned process "cmd.exe" with commandline "cmd /c mkdir 27905" (UID: 00000000-00003880) Spawned process "cmd.exe" with commandline "cmd /c copy /b Colon + Hiring + Dictionary + Recall 27905\\Recreation.pif" (UID: 00000000-00003256) Spawned process "cmd.exe" with commandline "cmd /c copy /b Configuring + Treasure 27905\\B" (UID: 00000000-00003664) Spawned process "Recreation.pif" with commandline "27905\\Recreation.pif 27905\\B" (UID: 00000000-00001708) Spawned process "PING.EXE" with commandline "ping -n 5 localhost" (UID: 00000000-00003252) Spawned process "jsc.exe" (UID: 00000000-00002892)3e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAd3QAAAAAAAAAAAAAAQAHiP//h3QAIAAAAAAAAAAHj4iP///4cAAAAAAAAAAAj////////4gwAAAAAAAAGP//+I//+I+IgQAAAAAAAI/4dmZm6Pj/92cAAAAAAAiIhmZmZmZ4+PhmcAAAAAB/+GboiIZmZv+PhncAAAAAj4Zmj4/+bmbviPhnIAAAB/h2Zo//jm7uaIj45nAAAAf4ZmaP/47o526P+OZwAAAIhmZu6IiO7o5uiI/mcAAASIZm7uiIju7m7miIjncAAHiGZu6P//juju7oiI53AAB4hmbu7///jo7m6IiOdwAAeIZubuj///ju7uiPjncAAHiGZm7uj///ju7oj453AABIhmaIiOj///h+6I+OdwAACIZo//juj//47oj/5nAAAAeHaPj/iPj/+O6I/+ZwAAAHiGaP//////7oiPjncAAAAIiGb/+I///uaI/+aAAAAAB4iGaIj/+OZoePhocAAAAACIeGZm7mZnh4/4iAAAAAAAB4eHZmZniHj//4AAAAAAAACId4iIiHf///gAAAAAAAAAB/iHd3iP//9wAAAAAAAAAAB4//////+HAAAAAAAAAAAAAAeP/4hwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==3f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAd3QAAAAAAAAAAAAAAQAHiP//h3QAIAAAAAAAAAAHj4iP///4cAAAAAAAAAAAj////////4gwAAAAAAAAGP//+I//+I+IgQAAAAAAAI/4dmZm6Pj/92cAAAAAAAiIhmZmZmZ4+PhmcAAAAAB/+GboiIZmZv+PhncAAAAAj4Zmj4/+bmbviPhnIAAAB/h2Zo//jm7uaIj45nAAAAf4ZmaP/47o526P+OZwAAAIhmZu6IiO7o5uiI/mcAAASIZm7uiIju7m7miIjncAAHiGZu6P//juju7oiI53AAB4hmbu7///jo7m6IiOdwAAeIZubuj///ju7uiPjncAAHiGZm7uj///ju7oj453AABIhmaIiOj///h+6I+OdwAACIZo//juj//47oj/5nAAAAeHaPj/iPj/+O6I/+ZwAAAHiGaP//////7oiPjncAAAAIiGb/+I///uaI/+aAAAAAB4iGaIj/+OZoePhocAAAAACIeGZm7mZnh4/4iAAAAAAAB4eHZmZniHj//4AAAAAAAACId4iIiHf///gAAAAAAAAAB/iHd3iP//9wAAAAAAAAAAB4//////+HAAAAAAAAAAAAAAeP/4hwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2fcffd3914b2555cd521d7c2d3c43e8e8af300f9ee161d3ae0c028206f55775b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790347535495,"unified_at":"2026-09-25T14:45:35.495Z","metadata":{"hashes":{"sha256":"2fcffd3914b2555cd521d7c2d3c43e8e8af300f9ee161d3ae0c028206f55775b","sha1":"c3c9c8a5c5a464089ce6e99de222488308e77fb4","md5":"1cd26d6f12d8bca67d347f972cbeb180","sha512":"c7a96a6c241c810a1931120e91ac7914f0a501373f40f6ad24d0c7333827e8c774086bb7a4d0b99eaa1fd2f52fd574b7fb9fdd0d830b27935d461db3198d424f","ssdeep":"12288:0LiST3s6063RJ8/boxRyDdFTUe6640bVlt1PEfrES398Otd5aXlfleBwBGWx+m3y:0D3s67ibooN/bVhEfJ39vjMeiGu+dooN","ssdeep_chunks":["12288:0LiST3s","12288:LiST3s6","12288:iST3s60","12288:ST3s606","12288:T3s6063","12288:3s6063R","12288:s6063RJ","12288:6063RJ8","12288:063RJ8/","12288:63RJ8/b","12288:3RJ8/bo","12288:RJ8/box","12288:J8/boxR","12288:8/boxRy","12288:/boxRyD","12288:boxRyDd","12288:oxRyDdF","12288:xRyDdFT","12288:RyDdFTU","12288:yDdFTUe","12288:DdFTUe6","12288:dFTUe66","12288:FTUe664","12288:TUe6640","12288:Ue6640b","12288:e6640bV","12288:6640bVl","12288:640bVlt","12288:40bVlt1","12288:0bVlt1P","12288:bVlt1PE","12288:Vlt1PEf","12288:lt1PEfr","12288:t1PEfrE","12288:1PEfrES","12288:PEfrES3","12288:EfrES39","12288:frES398","12288:rES398O","12288:ES398Ot","12288:S398Otd","12288:398Otd5","12288:98Otd5a","12288:8Otd5aX","12288:Otd5aXl","12288:td5aXlf","12288:d5aXlfl","12288:5aXlfle","12288:aXlfleB","12288:XlfleBw","12288:lfleBwB","12288:fleBwBG","12288:leBwBGW","12288:eBwBGWx","12288:BwBGWx+","12288:wBGWx+m","12288:BGWx+m3","12288:GWx+m3y","24576:0LiST3s","24576:LiST3s6","24576:iST3s60","24576:ST3s606","24576:T3s6063","24576:3s6063R","24576:s6063RJ","24576:6063RJ8","24576:063RJ8/","24576:63RJ8/b","24576:3RJ8/bo","24576:RJ8/box","24576:J8/boxR","24576:8/boxRy","24576:/boxRyD","24576:boxRyDd","24576:oxRyDdF","24576:xRyDdFT","24576:RyDdFTU","24576:yDdFTUe","24576:DdFTUe6","24576:dFTUe66","24576:FTUe664","24576:TUe6640","24576:Ue6640b","24576:e6640bV","24576:6640bVl","24576:640bVlt","24576:40bVlt1","24576:0bVlt1P","24576:bVlt1PE","24576:Vlt1PEf","24576:lt1PEfr","24576:t1PEfrE","24576:1PEfrES","24576:PEfrES3","24576:EfrES39","24576:frES398","24576:rES398O","24576:ES398Ot","24576:S398Otd","24576:398Otd5","24576:98Otd5a","24576:8Otd5aX","24576:Otd5aXl","24576:td5aXlf","24576:d5aXlfl","24576:5aXlfle","24576:aXlfleB","24576:XlfleBw","24576:lfleBwB","24576:fleBwBG","24576:leBwBGW","24576:eBwBGWx","24576:BwBGWx+","24576:wBGWx+m","24576:BGWx+m3","24576:GWx+m3y","12288:0D3s67i","12288:D3s67ib","12288:3s67ibo","12288:s67iboo","12288:67ibooN","12288:7ibooN/","12288:ibooN/b","12288:booN/bV","12288:ooN/bVh","12288:oN/bVhE","12288:N/bVhEf","12288:/bVhEfJ","12288:bVhEfJ3","12288:VhEfJ39","12288:hEfJ39v","12288:EfJ39vj","12288:fJ39vjM","12288:J39vjMe","12288:39vjMei","12288:9vjMeiG","12288:vjMeiGu","12288:jMeiGu+","12288:MeiGu+d","12288:eiGu+do","12288:iGu+doo","12288:Gu+dooN"],"imphash":"714858d86af7839c838d9f014dd17886"},"file_info":{"file_name":"MultiverseX.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":858810,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1706224607000,"last_seen":1706224793000,"last_multi_scan":1706224793000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":78},"sandbox_signatures":{"informative_count":203,"suspicious_count":14,"malicious_count":8,"total":225},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win32.7Zip","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Nekark.nemzw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Generic.3562977","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.QuasarRAT-10018765-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"ApplicUnwnt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.7zip.DB suspicious application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.bo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b04601 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Agent.myutno","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Generic BackDoor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject5.kgzdtq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.QSQM-8805","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Packed.7zip","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Adjusts debug privileges"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"malicious","value":"The input sample is signed with an invalid certificate"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"informative","value":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates a writable file in a temporary directory"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Checks internet connectivity using tracert/ping"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Tries to copy files"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"MultiverseX.exe\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"MultiverseX.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"MultiverseX.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"MultiverseX.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"MultiverseX.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"MultiverseX.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"MultiverseX.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"MultiverseX.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"MultiverseX.exe\")\n Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"MultiverseX.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"MultiverseX.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004508.00000000.66606.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"MultiverseX.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10\" (Indicator: \"SHA384\"; File: \"MultiverseX.exe\")\n Found reference to \"Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\" (Indicator: \"SHA384\"; File: \"MultiverseX.exe\")\n Found reference to \"Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=\" (Indicator: \"SHA384\"; File: \"MultiverseX.exe\")\n Found reference to \"Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\" (Indicator: \"SHA384\"; File: \"MultiverseX.exe\")\n Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\" (Indicator: \"SHA384\"; File: \"MultiverseX.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"MultiverseX.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"MultiverseX.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"MultiverseX.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"MultiverseX.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"MultiverseX.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"MultiverseX.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 35590-89-00421F0C\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 35590-89-00421F0C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.823896163444965","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"MultiverseX.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"MultiverseX.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"MultiverseX.exe\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"MultiverseX.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"MultiverseX.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"MultiverseX.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004508)\n \"MultiverseX.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004508)\n \"MultiverseX.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004508)\n \"MultiverseX.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004508)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"Z:\\7zsfxmm-51139022f6d790da60884077b63b2f265052be0b\\Output\\Win32\\7ZSfxMod.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"MultiverseX.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"MultiverseX.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"MultiverseX.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"MultiverseX.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"MultiverseX.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: MultiverseX.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"MultiverseX.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"MultiverseX.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"MultiverseX.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"MultiverseX.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"MultiverseX.exe\")\n Found reference to API \"FindResourceExA\" (Indicator: \"FindResource\"; File: \"MultiverseX.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"FindResourceExA\" (Indicator: \"FindResource\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 111269)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"MultiverseX.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"MultiverseX.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"MultiverseX.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"MultiverseX.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"MultiverseX.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"MultiverseX.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 74600000\n \"MultiverseX.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 74600000\n \"MultiverseX.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 74600000\n \"MultiverseX.exe\" loaded module \"KERNEL32\" at base 74880000\n \"MultiverseX.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 73d40000\n \"MultiverseX.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 74060000\n \"MultiverseX.exe\" loaded module \"EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL\" at base 74880000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"MultiverseX.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74B50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"MultiverseX.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"MultiverseX.exe\" was detected as \"7-Zip\" and name: \"Installer\"\n \"MultiverseX.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"MultiverseX.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"MultiverseX.exe\" was detected as \"7-Zip\" and name: \"Archive\"\n \"MultiverseX.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"MultiverseX.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"MultiverseX.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"MultiverseX.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"MultiverseX.exe\" file has an entrypoint instructions - \"call\t0x41a78c,jmp\t0x419f24,push\tebp,mov\tebp, esp,and\tdword ptr [0x433378], 0,sub\tesp, 0x24,push\tebx,xor\tebx, ebx,inc\tebx,or\tdword ptr [0x4305e8], ebx,push\t0xa,call\t0x41a9c1,test\teax, eax,je\t0x41a242,and\tdword ptr [ebp - 0x10], 0,xor\teax, eax,or\tdword ptr [0x4305e8], 2,xor\tecx, ecx,push\tesi,push\tedi,mov\tdword ptr [0x433378], ebx,lea\tedi, [ebp - 0x24],push\tebx,cpuid\t,mov\tesi, ebx,pop\tebx,mov\tdword ptr [edi], eax,mov\tdword ptr [edi + 4], esi,mov\tdword ptr [edi + 8], ecx,xor\tecx, ecx,mov\tdword ptr [edi + 0xc], edx,mov\teax, dword ptr [ebp - 0x24],mov\tedi, dword ptr [ebp - 0x20],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Norton\" (Indicator: \"norton\") in Source: MultiverseX.exe","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"MultiverseX.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"c:\\windows\\system32\\ntdll.dll\" [Source: MultiverseX.exe]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 460 -p 4508 -ip 4508\" (UID: 00000000-00007888)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4508 -s 588\" (UID: 00000000-00004044)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4508 -s 588\" (UID: 00000000-00007896)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 460 -p 4508 -ip 4508\" (UID: 00000000-00007888)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4508 -s 588\" (UID: 00000000-00004044)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4508 -s 588\" (UID: 00000000-00007896)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: 20:83:15:C8:2C:4A:57:E1:BD:8C:1A:D0:E7:C9:B5:36:E6:C0:74:05; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"MultiverseX.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"MultiverseX.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"MultiverseX.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"MultiverseX.exe\" queries basic process information of the \"C:\\MultiverseX.exe\" (UID: 4508)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: The input sample contains a known anti-VM trick","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"MultiverseX.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"MultiverseX.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"MultiverseX.exe\" trying to touch file \"C:\\MultiverseX.exe\"\n \"MultiverseX.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"MultiverseX.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"MultiverseX.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"MultiverseX.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"MultiverseX.exe\" trying to touch file \"C:\\MULTIVERSEX.EXE.LOCAL\"\n \"MultiverseX.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\comctl32.dll\"\n \"MultiverseX.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcrt.dll\"\n \"MultiverseX.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"MultiverseX.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"MultiverseX.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"MultiverseX.exe\" trying to access non-existent file \"C:\\MULTIVERSEX.EXE.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00004508\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"MultiverseX.exe\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"MultiverseX.exe\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"MultiverseX.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"7zAES\" (Indicator: \"aes\"; File: \"MultiverseX.exe\")\n Found string \"7zAES\" (Indicator: \"aes\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found string \"P~AeS\" (Indicator: \"aes\"; Source: \"00000000-00004508.00000000.66606.00430000.00000004.mdmp\")\n Found string \"PQAeS~\" (Indicator: \"aes\"; Source: \"00000000-00004508.00000000.66606.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"MultiverseX.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"MultiverseX.exe\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"MultiverseX.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"MultiverseX.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"MultiverseX.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"MultiverseX.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"MultiverseX.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"7-Zip: Data error.The archive is corrupted, or invalid password was entered.\" (Indicator: \"password\"; File: \"MultiverseX.exe\")\n Found string \"Enter password:\" (Indicator: \"password\"; File: \"MultiverseX.exe\")\n Found string \"The archive is corrupted, or invalid password was entered.\" (Indicator: \"password\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found string \"Enter password:\" (Indicator: \"password\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: MultiverseX.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004508.00000000.66606.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"MultiverseX.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"MultiverseX.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"MultiverseX.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"MultiverseX.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"MultiverseX.exe\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"MultiverseX.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"MultiverseX.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"MultiverseX.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"MultiverseX.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; File: \"MultiverseX.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"MultiverseX.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"MultiverseX.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"MultiverseX.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"MultiverseX.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"MultiverseX.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004508.00000000.66606.00426000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"AllocateAndInitializeSid\" which can \"Allocates and initializes a security identifier (SID) with up to eight subauthorities\" [Source: MultiverseX.exe]\n Observed import api \"CheckTokenMembership\" which can \"Determines whether a specified security identifier (SID) is enabled in an access token\" [Source: MultiverseX.exe]\n Observed import api \"FreeSid\" which can \"Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: MultiverseX.exe]\n Observed import api \"InitializeSid\" which can \"Initializes a security identifier (SID)\" [Source: MultiverseX.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"MultiverseX.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"MultiverseX.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"MultiverseX.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"MultiverseX.exe queries ProcessDebugPort (UID: 4508)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"MultiverseX.exe\" has resource with unusual entropy \"RT_ICON:7.97599778616\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00004508.00000000.66606.03270000.00000002.mdmp\n \"Progman\" (Program manager) in Source: 00000000-00004508.00000000.66606.03270000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"MultiverseX.exe\" claimed CRC 844168 while the actual is CRC 886450","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeW\n LockResource\n FindFirstFileW\n GetFileAttributesW\n UnhandledExceptionFilter\n FindResourceExA\n GetTempPathW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExW\n CreateThread\n GetSystemDirectoryW\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n GetVersionExW\n GetTickCount\n VirtualProtect\n LoadLibraryA\n GetFileSize\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n CreateFileMappingW\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n CreateFileW\n CreateFileA\n GetCommandLineW\n GetCommandLineA\n MapViewOfFile\n GetModuleHandleA\n GetModuleHandleW\n WriteFile\n CreateProcessW\n Sleep\n VirtualAlloc\n ShellExecuteW\n ShellExecuteExW\n SetWindowsHookExW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"sample.bin\" (Offset: 157432)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: The operation completed successfully. (0x0)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"cmd.exe\" called \"FindResourceW\" with parameter \"1946491624\" - (UID: 00000000-00002928)\n \"Recreation.pif\" called \"FindResourceW\" with parameter \"200\" - (UID: 00000000-00001708)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"tasklist.exe\" at 00000000-00003852-00000105-2902572\n \"tasklist.exe\" at 00000000-00002856-00000105-374709","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"MultiverseX.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"Found string \"findstr /I \"wrsa.exe\"\" (Indicator: \"wrsa.exe\"; Source: \"00000000-00002928-00000C41-10857035780\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"MultiverseX.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003204)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"MultiverseX.exe\" called \"IsWow64Process\" with parameter \"3204\" - (UID: 00000000-00003204)\n \"cmd.exe\" called \"IsWow64Process\" with parameter \"1728\" - (UID: 00000000-00001728)\n \"tasklist.exe\" called \"IsWow64Process\" with parameter \"3852\" - (UID: 00000000-00003852)\n \"findstr.exe\" called \"IsWow64Process\" with parameter \"3584\" - (UID: 00000000-00003584)\n \"tasklist.exe\" called \"IsWow64Process\" with parameter \"2856\" - (UID: 00000000-00002856)\n \"findstr.exe\" called \"IsWow64Process\" with parameter \"2444\" - (UID: 00000000-00002444)\n \"cmd.exe\" called \"IsWow64Process\" with parameter \"3880\" - (UID: 00000000-00003880)\n \"cmd.exe\" called \"IsWow64Process\" with parameter \"3664\" - (UID: 00000000-00003664)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"tasklist.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003852)\n \"Recreation.pif\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001708)\n \"PING.EXE\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003252)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"MultiverseX.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003204)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"MultiverseX.exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb4077b0d52d0000a0fd7f9a5cbb7700e0fd7f28ca500144a0fd7f00000000400000003f0000002400000000a0fd7f1cca5001c15cbb776082c2772400000000a0fd7f9a5cbb7700e0fd7f40ca50015789ba778083c2771317ad75d8eb4077 (UID: 00000000-00003204)\n \"MultiverseX.exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003204)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"tasklist.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003852)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003852)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003852)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002856)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002856)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"MultiverseX.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003204)\n \"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002928)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00003852)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"jsc.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_Version\" in \"jsc.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"MultiverseX.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Recreation.pif\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"MultiverseX.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"MultiverseX.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"MultiverseX.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\7ZipSfx.000 (UID: 00000000-00003204)\n \"MultiverseX.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00003204)\n \"cmd.exe\" called \"CreateDirectoryW\" with parameter 27905 (UID: 00000000-00003880)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to copy files","description":"Observed string: \"cmd /c copy /b Colon + Hiring + Dictionary + Recall 27905\\Recreation.pif\" (Indicator: \"/c copy \") in Source: 00000000-00002928-00000C41-15005749116\n Observed string: \"cmd /c copy /b Configuring + Treasure 27905\\B\" (Indicator: \"/c copy \") in Source: 00000000-00002928-00000C41-15390024273","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegConnectRegistryW\" (Indicator: \"RegConnectRegistry\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$33","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\AutoIt v3\\AutoIt\" in Source: 00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\n \"SOFTWARE\\Classes\\\" in Source: 00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\n \"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\" in Source: 00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00003204.00000001.66410.00270000.00000004.mdmp\n \"041700817-663127204-1001\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00003204.00000001.66410.00270000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"cmd.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\Recreation.pif\"\n \"cmd.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\B\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"jsc.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"$MinimumMotelMyspace = '0708012911753325445312517817'\" (Indicator: \"myspace\"; File: \"Configuring\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016003cdac66c@ADVAPI32.dll\"\n \"0e000f00ecdac66c@ADVAPI32.dll\"\n \"0e000f0048dbc66c@ADVAPI32.dll\"\n \"1100120024e3c66c@ADVAPI32.dll\"\n \"11001200c0e3c66c@ADVAPI32.dll\"\n \"1200130004e4c66c@ADVAPI32.dll\"\n \"120013005ce4c66c@ADVAPI32.dll\"\n \"140015008005c76c@ADVAPI32.dll\"\n \"140015009805c76c@ADVAPI32.dll\"\n \"14001500b005c76c@ADVAPI32.dll\"\n \"17001800c805c76c@ADVAPI32.dll\"\n \"0d000e00e005c76c@ADVAPI32.dll\"\n \"0d000e00ace4c66c@SHELL32.dll\"\n \"0d000e0028e5c66c@SHELL32.dll\"\n \"0f0010000c07c76c@ADVAPI32.dll\"\n \"140015004c07c76c@ADVAPI32.dll\"\n \"140015006407c76c@ADVAPI32.dll\"\n \"0c000d00ac07c76c@ADVAPI32.dll\"\n \"0c000d00bc07c76c@ADVAPI32.dll\"\n \"0e000f00cc07c76c@ADVAPI32.dll\"\n \"180019003409c76c@RPCRT4.dll\"\n \"130014006009c76c@RPCRT4.dll\"\n \"140015007409c76c@RPCRT4.dll\"\n \"160017008c09c76c@RPCRT4.dll\"\n \"0b000c000402c76c@WS2_32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$35","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"jsc.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00003204-00000C41-7506944515]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /k cmd < Until & exit\" [Source: 00000000-00003204-00000C41-7506944515]\n Observed system executable string:\"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00002928-00000C41-3649975207]\n Observed system executable string:\"%WINDIR%\\system32\\findstr.exe\" [Source: 00000000-00002928-00000C41-6510999094]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00002928-00000C41-14297168594]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe\" [Source: 00000000-00001708-00000C28-33160155946]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$36","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"JAzpCEDLKQoYaqi.JAzpCEDLKQoYaqi\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Recreation.pif\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Tries to copy files","description":"Process \"cmd.exe\" with commandline \"cmd /c copy /b Colon + Hiring + Dictionary + Recall 27905\\\\Recreation.pif\" (UID: 00000000-00003256)\n Process \"cmd.exe\" with commandline \"cmd /c copy /b Configuring + Treasure 27905\\\\B\" (UID: 00000000-00003664)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-291","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"MultiverseX.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\Colon\"\n \"MultiverseX.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\Configuring\"\n \"MultiverseX.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\Dictionary\"\n \"MultiverseX.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\Hiring\"\n \"MultiverseX.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\Recall\"\n \"MultiverseX.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\Treasure\"\n \"MultiverseX.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\Until\"\n \"cmd.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\Recreation.pif\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"MultiverseX.exe\" connecting to \"\\ThemeApiPort\"\n \"Recreation.pif\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"MultiverseX.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"tasklist.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"Recreation.pif\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"PING.EXE\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\cmd.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\tasklist.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\findstr.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\Recreation.pif\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\PING.EXE\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$37","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"MultiverseX.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"MultiverseX.exe\" reads file \"c:\\multiversex.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"MultiverseX.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"MultiverseX.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"cmd.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"Recreation.pif\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"MultiverseX.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\7zipsfx.000\\colon\"\n \"MultiverseX.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\7zipsfx.000\\configuring\"\n \"MultiverseX.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\7zipsfx.000\\dictionary\"\n \"MultiverseX.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\7zipsfx.000\\hiring\"\n \"MultiverseX.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\7zipsfx.000\\recall\"\n \"MultiverseX.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\7zipsfx.000\\treasure\"\n \"MultiverseX.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\7zipsfx.000\\until\"\n \"cmd.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\7zipsfx.000\\27905\\recreation.pif\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"tasklist.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003852)\n \"tasklist.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002856)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Checks internet connectivity using tracert/ping","description":"Process \"PING.EXE\" with commandline \"ping -n 5 localhost\" (UID: 00000000-00003252)","origin":"Monitored Target","mitre_attack_id":"T1016.001","relevance":1,"id":"target-348","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"HttpQueryInfoW\" (Indicator: \"HttpQueryInfo\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"HttpSendRequestW\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.0.0\"\n \"0.0.0.0\"\n \"255.255.255.255\"\n \"6.0.2.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.autoitscript.com/autoit3/filedescriptionautoit\" - Source: \"00000000-00001708.00000001.68069.00BF5000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetAddConnection\" which can \"makes a connection to a network resource\" [Source: Recreation.pif]\n Observed import api \"WNetCancelConnection\" which can \"cancels an existing network connection\" [Source: Recreation.pif]\n Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: Recreation.pif]\n Observed import api \"WNetUseConnection\" which can \"makes a connection to a network resource\" [Source: Recreation.pif]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"Empties the Recycle Bin on the specified drive\" [Source: Recreation.pif]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"MultiverseX.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"268504027\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"Recreation.pif\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1258358885\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"Recreation.pif\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1258358885\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"MultiverseX.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: Recreation.pif)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00002928-00000C41-3649975207]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"findstr /I \"avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00002928-00000C41-6510999094\")\n Found string \"findstr /I \"wrsa.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00002928-00000C41-10857035780\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /I \"avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe\"\" (UID: 00000000-00003584)\n Process \"findstr.exe\" with commandline \"findstr /I \"wrsa.exe\"\" (UID: 00000000-00002444)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Adjusts debug privileges","description":"\"tasklist.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"\\RPC Control\\OLEEC54AB626D804F1696B668852D29\"\n \"tasklist.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"tasklist.exe\" called an API \"AdjustTokenPrivileges\"on file: \\RPC Control\\OLEEC54AB626D804F1696B668852D29\" (UID: 00000000-00003852)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00001708.00000001.68069.00BBD000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Recreation.pif\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"MultiverseX.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"Recreation.pif\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Recreation.pif\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\7ZipSfx.000\\27905\\Recreation.pif]- [targetUID: 00000000-00003204]\n \"jsc.exe\" has type \"PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%TEMP%\\7ZipSfx.000\\27905\\jsc.exe]- [targetUID: 00000000-00001708]\n \"Colon\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\7ZipSfx.000\\Colon]- [targetUID: 00000000-00003204]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Recreation.pif\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\7ZipSfx.000\\27905\\Recreation.pif]- [targetUID: 00000000-00003204]\n \"jsc.exe\" has type \"PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%TEMP%\\7ZipSfx.000\\27905\\jsc.exe]- [targetUID: 00000000-00001708]\n \"Colon\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\7ZipSfx.000\\Colon]- [targetUID: 00000000-00003204]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$3a","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$3b","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping -n 5 localhost\" (UID: 00000000-00003252)","origin":"Monitored Target","mitre_attack_id":"T1018","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"ping 0, GenuineIntel\" (Indicator: \"ping\"; Source: \"00000000-00001708.00000000.66544.00610000.00000004.mdmp, 00000000-00001708.00000001.68069.00610000.00000004.mdmp\")\n Found string \"- ping -n 5 localhost\" (Indicator: \"ping\"; Source: \"00000000-00001708.00000000.66544.01190000.00000002.mdmp\")\n Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00001708.00000001.68069.00BBD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"MultiverseX.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\B\" for deletion\n \"MultiverseX.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\Recreation.pif\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"MultiverseX.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\B\" with delete access\n \"MultiverseX.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\Recreation.pif\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"MultiverseX.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"MultiverseX.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"Recreation.pif\" called \"CreateProcessW\" with parameter \"%TEMP%\\7ZipSfx.000\\27905\\jsc.exe\" - (UID: 00000000-00001708)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"$3c","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00003852)\n Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00002856)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"Recreation.pif\" allocated memory in \"%TEMP%\\7ZipSfx.000\\27905\\Recreation.pif\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Recreation.pif\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\jsc.exe\" (Handle: 492)\n \"Recreation.pif\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\jsc.exe\" (Handle: 492)\n \"Recreation.pif\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\jsc.exe\" (Handle: 492)\n \"Recreation.pif\" wrote 98304 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\jsc.exe\" (Handle: 492)\n \"Recreation.pif\" wrote 472 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\27905\\jsc.exe\" (Handle: 492)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"65b2ec98513708d5100061c0"},{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]}]},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":102,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Sample Crashed","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"65b2ec98513708d5100061c0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"MultiverseX.exe","analysis_start_time":"2024-01-25T23:19:53+00:00","indicators_count":{"informative":101,"suspicious":8,"malicious":2},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true},{"id":"65b2ebdec1de42c34d03bb06","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"MultiverseX.exe","analysis_start_time":"2024-01-25T23:16:47+00:00","indicators_count":{"informative":198,"suspicious":30,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"JAzpCEDLKQoYaqi.JAzpCEDLKQoYaqi","ttl":64090,"country":"-","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}],"processes":[{"pid":3204,"ppid":0,"name":"MultiverseX.exe","command_line":"","sha256":"2fcffd3914b2555cd521d7c2d3c43e8e8af300f9ee161d3ae0c028206f55775b","normalized_path":"C:\\MultiverseX.exe","uid":"00000000-00003204","icon":"$3e"},{"pid":1728,"ppid":3204,"name":"cmd.exe","command_line":"/k cmd < Until & exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00003204","uid":"00000000-00001728"},{"pid":2928,"ppid":1728,"name":"cmd.exe","command_line":"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001728","uid":"00000000-00002928"},{"pid":3852,"ppid":2928,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00002928","uid":"00000000-00003852"},{"pid":3584,"ppid":2928,"name":"findstr.exe","command_line":"findstr /I \"avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe\"","sha256":"28feb2fec791ef44cf24a61c4bf175b00dba030b53ab1b5b36aed898a2f5cf37","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00002928","uid":"00000000-00003584"},{"pid":2856,"ppid":2928,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00002928","uid":"00000000-00002856"},{"pid":2444,"ppid":2928,"name":"findstr.exe","command_line":"findstr /I \"wrsa.exe\"","sha256":"28feb2fec791ef44cf24a61c4bf175b00dba030b53ab1b5b36aed898a2f5cf37","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00002928","uid":"00000000-00002444"},{"pid":3880,"ppid":2928,"name":"cmd.exe","command_line":"cmd /c mkdir 27905","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002928","uid":"00000000-00003880"},{"pid":3256,"ppid":2928,"name":"cmd.exe","command_line":"cmd /c copy /b Colon + Hiring + Dictionary + Recall 27905\\Recreation.pif","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002928","uid":"00000000-00003256"},{"pid":3664,"ppid":2928,"name":"cmd.exe","command_line":"cmd /c copy /b Configuring + Treasure 27905\\B","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002928","uid":"00000000-00003664"},{"pid":1708,"ppid":2928,"name":"Recreation.pif","command_line":"27905\\Recreation.pif 27905\\B","sha256":"f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3","normalized_path":"%TEMP%\\7ZipSfx.000\\27905\\Recreation.pif","parent_uid":"00000000-00002928","uid":"00000000-00001708"},{"pid":3252,"ppid":2928,"name":"PING.EXE","command_line":"ping -n 5 localhost","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\system32\\PING.EXE","parent_uid":"00000000-00002928","uid":"00000000-00003252"},{"pid":2892,"ppid":0,"name":"jsc.exe","command_line":"","sha256":"7410599261912ddd9f7136bf1142bd14358beefa4126cde47e18fc9f6606a569","normalized_path":"%TEMP%\\7ZipSfx.000\\27905\\jsc.exe","uid":"00000000-00002892","icon":"$3f"}],"all_imported_dlls":["gdi32.dll","advapi32.dll","rpcrt4.dll","windows.storage.dll","VxSSL32.dll","ws2_32.dll","fltLib.dll","uxtheme.dll","wow64.dll","ucrtbase.dll","cfgmgr32.dll","user32.dll","kernel32.dll","shlwapi.dll","ntdll.dll","win32u.dll","msvcp_win.dll","msvcrt.dll","profapi.dll","wow64win.dll","sechost.dll","sspicli.dll","cryptbase.dll","bcryptprimitives.dll","shell32.dll","KernelBase.dll","gdi32full.dll","combase.dll","wow64cpu.dll","SHCore.dll","kernel.appcore.dll","powrprof.dll","ole32.dll","comctl32.dll","imm32.dll","apphelp.dll","oleaut32.dll","urlmon.dll","NapiNSP.dll","dwmapi.dll","ieframe.dll","wtsapi32.dll","wbemprox.dll","nsi.dll","winbrand.dll","mpr.dll","nlaapi.dll","usp10.dll","wkscli.dll","RpcRtRemote.dll","winmm.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","dbghelp.dll","rsaenh.dll","mswsock.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wsock32.dll","FWPUCLNT.DLL","netutils.dll","samcli.dll","wship6.dll","api-ms-win-downlevel-version-l1-1-0.dll","winsta.dll","ntdsapi.dll","msctf.dll","normaliz.dll","basebrd.dll","cryptsp.dll","fastprox.dll","winnsi.dll","clbcatq.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","devobj.dll","IPHLPAPI.DLL","pnrpnsp.dll","winrnr.dll","WSHTCPIP.DLL","ntmarta.dll","userenv.dll","secur32.dll","netapi32.dll","comdlg32.dll","rasadhlp.dll","Wldap32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","rpcss.dll","version.dll","srvcli.dll","dnsapi.dll","api-ms-win-core-synch-l1-2-0.dll","iertutil.dll","wmiutils.dll","lpk.dll","propsys.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wininet.dll","setupapi.dll","wbemcomn.dll","psapi.dll","framedynos.dll","wbemsvc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"B","sha256":"b9d1d3050460f1e608e0407b71eb73e0ceca733e885144e1b8152ad31b679cea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Recreation.pif","sha256":"f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Colon","sha256":"0a73ab15c0fa1bf2242bb6c53e5bcde02d411df9fb00d56c711a98fda629e831","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Configuring","sha256":"2d2840dfeea27fb2bd0c10b5f8b1005220d4c9d87683d3ac87d713dd86654e66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Dictionary","sha256":"fbae3f7d9d57688e221a575a070df21948cec32798a2e1598d81140161c2eed8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Hiring","sha256":"f7ef03c59841cfc266d6325bb2111c7453277ed01449dee8a7ecc48c7ee59eb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Recall","sha256":"5cf394783e1d49e20dcff4501f795d0311667c35b3b3efc22e892e2c129affe2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Treasure","sha256":"c1e89ecf9662cc0e5b4bf1d7d1be26b6b62150e09cc475235d3cb02a55248bdd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Until","sha256":"050584fb78346ac386a8eb1abc08e38f780c66cd8577ae25c161eda556378477","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"jsc.exe","sha256":"7410599261912ddd9f7136bf1142bd14358beefa4126cde47e18fc9f6606a569","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%TEMP%\\7ZipSfx.000","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%TEMP%\\7ZipSfx.000\\Colon","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%TEMP%\\7ZipSfx.000\\Configuring","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%TEMP%\\7ZipSfx.000\\Dictionary","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%TEMP%\\7ZipSfx.000\\Hiring","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%TEMP%\\7ZipSfx.000\\Recall","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%TEMP%\\7ZipSfx.000\\Treasure","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%TEMP%\\7ZipSfx.000\\Until","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%TEMP%\\7ZipSfx.000\\27905\\Recreation.pif","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%TEMP%\\7ZipSfx.000\\27905\\B","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"path":"%TEMP%\\7ZipSfx.000\\27905\\jsc.exe","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b2ebdec1de42c34d03bb06"}]}]}},"report_ids":{"sandbox_job_ids":["65b2ec98513708d5100061c0","65b2ebdec1de42c34d03bb06"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Packed.7zip Sample 2fcffd3914b2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2fcffd3914b2…. Malware family: Packed.7zip. Threat score 100/100. 14/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2fcffd3914b2555cd521d7c2d3c43e8e8af300f9ee161d3ae0c028206f55775b"}],["$","meta","4",{"property":"og:title","content":"Malicious Packed.7zip Sample 2fcffd3914b2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2fcffd3914b2…. Malware family: Packed.7zip. Threat score 100/100. 14/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2fcffd3914b2555cd521d7c2d3c43e8e8af300f9ee161d3ae0c028206f55775b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Packed.7zip Sample 2fcffd3914b2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2fcffd3914b2…. Malware family: Packed.7zip. Threat score 100/100. 14/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L40","11",{}]]