26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CVE-2017-0147 Sample 32f24601153b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 32f24601153b…. Malware family: CVE-2017-0147. Threat score 100/100. 23/27 AV engines flagged this file. 15 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf","keywords":["Malicious","CVE-2017-0147","malware analysis","sandbox report","threat intelligence","32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf"],"about":{"@type":"SoftwareApplication","name":"mssecsvc.exe","applicationCategory":["peexe","executable"],"identifier":"32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CVE-2017-0147","antivirusDetections":{"malicious":23,"total":27},"behavioralIndicators":{"malicious":15,"suspicious":31},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T469,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008504.00000000.249111.0040A000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00008504.00000000.249111.0040A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00008504.00000000.249111.0040A000.00000002.mdmp")28:T41a,Found reference to API "CryptAcquireContextA" (Indicator: "CryptAcquireContext"; File: "32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin") Found reference to API "CryptGenKey" (Indicator: "CryptGenKey"; File: "32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin")29:T28a0,Found XOR loop in file "sample.bin" at offset 339393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 403886; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 421714; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 426331; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 917196; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 934230; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1073423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1198427; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1227340; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1245343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1299139; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1448346; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1488018; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1525821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1527631; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1539834; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1544494; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1829729; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1910849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2010039; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2029546; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2213148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2543293; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2700368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2743037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2897487; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2901368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3033487; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3115333; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3161404; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3200534; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3365317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3399637; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3405403; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3471637; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3527844; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3679942; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3696631; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3708210; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 28413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 309149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 316172; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 394121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 403658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 428329; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 540810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 595451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 649641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 668570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 698974; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 730914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 870975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 966834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1225866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1241860; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1267027; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1308147; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1399405; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1614587; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1643133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1645325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1703739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1777324; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1832432; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1859909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1903191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1950206; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1978858; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1983964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2035200; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2096736; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2176993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2384335; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2385467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2386035; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2456212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2477142; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2598960; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2606465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2759071; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2860185; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3017711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3043830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3235840; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3487729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3488182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3491108; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3591302; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3598743; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3677306; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3683749; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 467772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 514641; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 600560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 609850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 748483; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 757313; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 759765; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 763828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 791404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 957857; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 989123; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1087679; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1093231; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1180030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1231384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1256032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1465392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1506735; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1528380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1663812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1690498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1694017; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1711627; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1739336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1789219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1803074; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1822184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1824857; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1850916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1857606; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1857878; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1946926; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2187132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2419381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2549107; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2608097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2636259; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2650983; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2788685; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2888940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2923686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3111682; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3127452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3228341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3241065; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3299243; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3329048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3500696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3600663; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3693469; code bytes = 80302a:T775," HTTP/1.1 200 OK\nDate: Sat\n 01 Nov 2025 17:08:35 GMT\nContent-Type: text/html;charset=UTF-8\nTransfer-Encoding: chunked\nConnection: keep-alive\nServer-Timing: cfEdge;dur=23\ncfOrigin;dur=0\nx-sinkhole: sinkhole@blacklistthisdomain.com\nVary: accept-encoding\nReport-To: {\"group\":\"cf-nel\"\n\"max_age\":604800\n\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B82lfe71ELefFPCLVXRTqQ%2FAaw6UtUkJyvsKu%2FWPXiKbfZ%2BP4YBeSj%2Fpb7BsViIEZ%2F5Bar9MWDG5wkD411RsYt%2FI9%2F57ARO%2BmdnT3Vgm1dhB31F%2FirwJ%2BWpsbe8a9gztf%2BfDwignw2WvB9%2BPyv%2BF\"}]}\nNel: {\"report_to\":\"cf-nel\"\n\"success_fraction\":0.0\n\"max_age\":604800}\nServer: cloudflare\nCF-RAY: 997cfebafedcd7ab-LAX\nalt-svc: h3=\":443\"; ma=86400 with response body ==>33633A32313A34343A34663A34333A35343A35393A35303A34353A32303A36383A37343A36643A36633A33653A30613A33633A36323A36663A36343A37393A33.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69063e641d29a99d3b09fe07"},{"report_type":"sandbox","report_id":"658a6881be5fb8a405010874"},{"report_type":"sandbox","report_id":"6010e5f5cc03087c287a4c5c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69063e641d29a99d3b09fe07"},{"report_type":"sandbox","report_id":"658a6881be5fb8a405010874"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"},{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"},{"report_type":"sandbox","report_id":"6010e5f5cc03087c287a4c5c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceA@ADVAPI32.DLL at 00008910-00000884-4687-3-00408090\n OpenServiceA@ADVAPI32.DLL at 00009327-00000784-7109-103-00401CE8","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"},{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc with unusual entropies 7.99522611944\n 7.9998679751","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"},{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"},{"report_type":"sandbox","report_id":"658a6881be5fb8a405010874"},{"report_type":"sandbox","report_id":"6010e5f5cc03087c287a4c5c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"},{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"},{"report_type":"sandbox","report_id":"6010e5f5cc03087c287a4c5c"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/64 reputation engines marked \"http://www.ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"},{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"},{"report_type":"sandbox","report_id":"6010e5f5cc03087c287a4c5c"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00008910-00000884-4687-6-00407CE0\n FindResourceA@KERNEL32.DLL at 00009327-00000784-7109-42-00401DAB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"},{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)\n \"tasksche.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"},{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"tasksche.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.2/31, 192.168.56.4/30, 192.168.56.8/29, 192.168.56.16/30, ...\"","origin":"Network Traffic","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00008910-00000884-4687-44-00406F50\n recv@WS2_32.DLL at 00008910-00000884-4687-43-004072A0\n recv@WS2_32.DLL at 00008910-00000884-4687-49-00401370\n recv@WS2_32.DLL at 00008910-00000884-4687-48-00401B70\n recv@WS2_32.DLL at 00008910-00000884-4687-61-00401980","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"},{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions: .sqlitedb\n .der\n .key\n .csr\n .pem\n .ott\n .stw\n .3ds\n .3dm\n .ots\n .stc\n .slk\n .odp\n .sxd\n .uop\n .otg\n .mml\n .lay6\n .sqlite3\n .accdb\n .db\n .odb\n .myd\n .ibd\n .ldf\n .cpp\n .asm\n .cmd\n .vb\n .dip\n .sch\n .asp\n .java\n .class\n .mp3\n .swf\n .wmv\n .vob\n .avi\n .mp4\n .mkv\n .flv\n .mid\n .m4u\n .ai\n .nef\n .cgm\n .gif\n .bmp\n .jpeg\n .rar\n .gz\n .tar\n .tbk\n .PAQ\n .aes\n .vmx\n .sldm\n .sti\n .602\n .pdf\n .wks\n .rtf\n .txt\n .edb","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"tasksche.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"},{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"},{"report_type":"sandbox","report_id":"6010e5f5cc03087c287a4c5c"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%WINDIR%\\tasksche.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"},{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"},{"report_type":"sandbox","report_id":"6010e5f5cc03087c287a4c5c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"c0df10771cf90f77ccf80f770d64117700000000c011fb7500000000fc3efb7500000000e013fb75000000009457ee7525e01077c6e0107700000000bc6aed7500000000cf31fb75000000009319ee75000000002c32fb7500000000\" to virtual address \"0x770B1000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"7d07147781ed1277ae861177c6e01077effd13772d16127760141477478d1177a8e210776089117700000000ad3736768b2d3676b641367600000000\" to virtual address \"0x72DF1000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"0efc137781ed1277ae861177c6e01077effd13772d161277c0fc0f77da8f1a7760141477478d1177a8e210776089117700000000ad3736768b2d3676b641367600000000\" to virtual address \"0x72E81000\" (part of module \"WSHIP6.DLL\")\n \"\" wrote bytes \"711146017a3b4501ab8b02007f950200fc8c0200729602006cc805001ecd42017d264201\" to virtual address \"0x75D007E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"},{"report_type":"sandbox","report_id":"6010e5f5cc03087c287a4c5c"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"61/72 Antivirus vendors marked dropped file \"tasksche.exe\" as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 84% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"61/72 Antivirus vendors marked spawned process \"tasksche.exe\" (PID: 784) as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 84% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"malicious","category":"Installation/Persistance","name":"Creates a system file in windows directory","description":"\"\" created file \"%WINDIR%\\tasksche.exe\"","origin":"API Call","relevance":7,"id":"api-5","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\tasksche.exe\" (Handle: 708)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\tasksche.exe\" (Handle: 708)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\tasksche.exe\" (Handle: 708)\n \"\" wrote 8 bytes to a remote process \"%WINDIR%\\tasksche.exe\" (Handle: 708)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 60 (or more) hosts in at least 22 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"malicious","category":"Network Related","name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.2/31, 192.168.56.4/30, 192.168.56.8/29, 192.168.56.16/28, 192.168.56.32/27, 192.168.56.64/26, 192.168.56.128/26, 192.168.56.192/27, 192.168.56.224/28, 192.168.56.240/29, 192.168.56.248/30, 192.168.56.252/31, 192.168.56.254/32\"","origin":"Network Traffic","relevance":10,"id":"network-31","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$38","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$39","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"$3a","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5a69b3557ca3e1428c07d1d8"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Ransomware Soup_RASAPI32\" (Filter: 14; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Ransomware Soup_RASMANCS\" (Filter: 14; Subtree: 0)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"},{"report_type":"sandbox","report_id":"6010e5f5cc03087c287a4c5c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"59184eb8aac2ed695f7ea7c8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"658a6881be5fb8a405010874"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2A\" (Indicator: \"ChangeServiceConfig\"; File: \"32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"658a6881be5fb8a405010874"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"658a6881be5fb8a405010874"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"658a6881be5fb8a405010874"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"658a6881be5fb8a405010874"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"