21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 342f9acdb9b8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 342f9acdb9b8…. Malware family: Zusy.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978"],"about":{"@type":"SoftwareApplication","name":"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A","applicationCategory":["peexe","executable"],"identifier":"342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T401,"\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" "Local\_!MSFTHISTORY!_" "Local\ZoneAttributeCacheCounterMutex" "Local\ZonesLockedCacheCounterMutex" "Local\ZonesCacheCounterMutex" "Local\c:!users!hllk3uc!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "RasPbFile" "Local\ZonesCounterMutex" "Local\WininetProxyRegistryMutex" "Local\c:!users!hllk3uc!appdata!roaming!microsoft!windows!cookies!" "IESQMMUTEX_0_208" "Local\WininetConnectionMutex" "Local\WininetStartupMutex" "Local\c:!users!hllk3uc!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!hllk3uc!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!hllk3uc!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex"23:T50e,Found malicious artifacts related to "216.58.213.132" (ASN: , Owner: ): ... File SHA256: 1803b43565af736297d45f9d9e85758bf804e2ab8b97b9936a38acff1f49de0b (AV positives: 55/65 scanned on 08/24/2017 09:03:37) File SHA256: 8d039ed0a385e326acb02a2a673039dee3a01582d8fef9fb3110956c190038ed (AV positives: 55/64 scanned on 08/24/2017 01:41:40) File SHA256: 21a4963fd54702d376dfbf81da40504bfe554c487341323c3f7f2d1e14d61e18 (AV positives: 52/63 scanned on 08/23/2017 20:42:01) File SHA256: 062da35043f823b21b9998985630b528b6c3fd7c73521e5ca71c12564f0036de (AV positives: 54/64 scanned on 08/23/2017 20:40:12) File SHA256: 12fdcd7611554c559d8b6d9ff091007032fddef40df4c48b7b46505983b82f7a (AV positives: 54/65 scanned on 08/23/2017 16:13:28) File SHA256: 9e3f4a4eacc7df17d007eff78b055791364bed271e07978751f0201c492da486 (Scanned on 05/10/2017 02:53:29) File SHA256: 4f21724b9b5c0d545ae0f9f6a4a45d3b7a7c3f69584c4d64fc7bc3f624461277 (Scanned on 05/10/2017 02:33:50) File SHA256: 6342d3e7654ec89074cb9898c9229318835ce86f81aad0fd855745ac5d58165e (Scanned on 05/10/2017 01:44:44) File SHA256: f838fbc458f993f9169588d1ac9da97a51e67a421fd06cf4aa49172b5947c965 (Scanned on 05/10/2017 01:13:15) File SHA256: 42fffc6c01dc7ba46765bc69a9cc6bfceace62283fc7ca033f443228623cb9a5 (Scanned on 05/09/2017 23:57:27)24:T1506,"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000024ef1200000000007000000074ef1200fefffffffcee1200cf00eb76d600eb761bddef76700000003800000074ef120000000000d0ee12000000000038ef1200 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000098e65b0000001b02f72f17013ce45b01ff2bea7698e65b0195e1e676cf211700feffffff435cea765059ea7634020000400200008a051b0288051b021000000080000000ff2bea7653d6a67720a3ad6cac012f0000002f00010000004869320013009d000c00000000d13e73ac012f0000002f0088051b02140098000c0000000c000000bceeea76806d2f0000001b02200000001500930000000000d0183500706a2f00906b2f00c80c3600386f2f0000001b0230e55b01d0183500b0e65b0195e1e676f72f1700feffffffff2bea769a2aea7620a3ad6c10a3ad6c00000000 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ef7600002f0020000000003d3500f4ee12000464ea7638012f00e063ea7613ddef760000000000002f00083d35006dd11e75d7c48cbc6caed07600000000000000006802000008eb350050012f000100000000002f0050012f000c000000083d350050012f0002000002180000009f03009c4500000000000000000000000300000094ee1200800000001f030000000000004025006545000000c0752675e885360000000000c0752675b0ee1200d42d2f0000000000502d2f0008ef1200dbd21e75083d350008eb35007fc58cbc45000000ff2bea76b7dcef760000000004022f00 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000d7d6a60000009802486932013ce45b010000000098e65b0195e1e676cf211700feffffff435cea765059ea7634020000400200008a05980288059802100000008000000090009802dd57eb76dd59eb764869320084e55b010100000048693200e80f98020000000000f00000e80f98027ce55b0188059802000098020000980200009802bceeea76000098020000980200009802b4e55b0103000000000000004002000002100000b0e55b018a2eeb76000098020a000000340200009000980200009802ff2bea76d3d5a677020000000c026e0000006e000100000050019802 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000d7d6040000006100486932013ce4f9010000000098e6f90195e1e676cf211700feffffff435cea765059ea7634020000400200008a05610088056100100000008000000090006100dd57eb76dd59eb764869320084e5f9010100000048693200e80f61000000000000f00000e80f61007ce5f90188056100000061000000610000006100bceeea76000061000000610000006100b4e5f90103000000000000004002000002100000b0e5f9018a2eeb76000061000a000000340200009000610000006100ff2bea76d3d50477020000000c026e0000006e000100000050016100 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000d7d6f40000004701486932013ce409020000000098e6090295e1e676cf211700feffffff435cea765059ea7634020000400200008a05470188054701100000008000000090004701dd57eb76dd59eb764869320084e509020100000048693200e80f47010000000000f00000e80f47017ce5090288054701000047010000470100004701bceeea76000047010000470100004701b4e5090203000000000000004002000002100000b0e509028a2eeb76000047010a000000340200009000470100004701ff2bea76d3d5f474020000000c026e0000006e000100000050014701 (UID: 00000000-00005560)25:T8da,"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")26:Ta76,"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter C:\NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00005560)27:T2a6f,"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00005560) "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00005560) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005880) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005880)28:T2e49,Found reference to API (Indicator: "CloseHandle"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "Sleep"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "TerminateProcess"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetExitCodeProcess"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "TerminateThread"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetExitCodeThread"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "CreateThread"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "CreateProcessA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetStartupInfoA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "CreatePipe"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetProcAddress"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "LoadLibraryA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "ReadFile"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "PeekNamedPipe"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetTempPathA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "WriteFile"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetFileSize"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "CreateFileA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "FreeLibrary"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetModuleFileNameA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "DeleteFileA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "CopyFileA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetLastError"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "SetThreadPriority"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetCurrentThread"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "SetPriorityClass"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetCurrentProcess"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "lstrcatA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "lstrcpyA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetShortPathNameA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "GetModuleHandleA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "LoadStringA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "ShellExecuteExA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "HttpEndRequestA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "InternetWriteFile"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "HttpSendRequestExA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "HttpOpenRequestA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "InternetCloseHandle"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "InternetConnectA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "InternetOpenA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "HttpSendRequestA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "InternetOpenUrlA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "RegCloseKey"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "RegQueryValueExA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "RegOpenKeyExA"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "InternetReadFile"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "SetProcessPriorityBoost"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "SetPriorityClass"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "HttpEndRequestA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "InternetWriteFile"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestExA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp")29:T10a2,"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "C:\NEWSREELS_SAMPLE_A2CD1189860B9BA214421AAB86ECBC8A.EXE" at base 400000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "SECUR32.DLL" at base 74a80000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "RPCRT4.DLL" at base 763b0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "SHELL32.DLL" at base 75680000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "OLE32.DLL" at base 76800000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "ADVAPI32.DLL" at base 76fa0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "KERNEL32.DLL" at base 751a0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "PROFAPI.DLL" at base 74d60000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70db0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 74fd0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "WS2_32.DLL" at base 75280000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "WINHTTP.DLL" at base 71150000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74720000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74710000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76c10000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "IPHLPAPI.DLL" at base 730a0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "URLMON.DLL" at base 76d00000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6b100000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "DNSAPI.DLL" at base 745e0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "CRYPTBASE.DLL" at base 74c50000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "DHCPCSVC6.DLL" at base 72f70000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74280000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "RASADHLP.DLL" at base 71060000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "CLBCATQ.DLL" at base 76460000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "DHCPCSVC.DLL" at base 72ef0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6caa0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76c10000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "CRYPTSP.DLL" at base 74760000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744f0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "RPCRTREMOTE.DLL" at base 74cf0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6c950000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "OLEAUT32.DLL" at base 750a0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 750a0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 76960000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72fd0000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "COMCTL32.DLL" at base 73c20000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75280000 "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c000002a:T5e5,"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD"; Key: ""; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: ""; Value: "")2b:T7d6,"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "DEFAULTCONNECTIONSETTINGS"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2c:T896,"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\version.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\system32\version.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\FLTLIB.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Secur32.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\system32\Secur32.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\SSPICLI.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\system32\SSPICLI.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Users\GpDSAQb\AppData\Local\Microsoft\Windows\Temporary Internet Files" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\api-ms-win-downlevel-advapi32-l2-1-0.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to touch file "C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll"2d:T97c,"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\version.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\FLTLIB.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\Secur32.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\SSPICLI.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\api-ms-win-downlevel-advapi32-l2-1-0.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\WINNSI.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\api-ms-win-downlevel-shlwapi-l2-1-0.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\DNSAPI.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\dhcpcsvc6.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\rasadhlp.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\dhcpcsvc.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\CRYPTSP.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\RpcRtRemote.dll" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL"2e:T5ee,"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\Device\RasAcd" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "C:\NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe.Local\" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\Device\NetBT_Tcpip6_{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}" "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" trying to access non-existent file "\Device\HarddiskVolume2\NEWSREELS_SAMPLE_A2CD1189860B9BA214421AAB86ECBC8A.EXE.LOCAL"2f:T8a9,Found reference to API "HttpSendRequestExA" (Indicator: "HttpSendRequest"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API "19678804155171,5796,3198,,InternetOpenA,Wininet.dll,"254:17:05.640",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp") Found reference to API "HttpSendRequestExA" (Indicator: "HttpSendRequest"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API "34974473018899,5796,3198,,InternetOpenA,Wininet.dll,"255:57:58.028",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005560.00000003.77544.002F0000.00000004.mdmp")30:T656,Found URL "http://140.116.70.8/index.asp" - Source: "00000000-00005560.00000000.66255.002F0000.00000004.mdmp") Found URL "http://140.116.70.8/index.aspy0sdv" - Source: "00000000-00005560.00000000.66255.002F0000.00000004.mdmp") Found URL "http://140.116.70.8/index.asplocal" - Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp") Found URL "http://140.116.70.8/img/photo.jpghttp://140.116.70.8/img/photo.jpg://1xv0/4lmemmicrosoft" - Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp") Found URL "http://140.116.70.8/img/photo.jpghttp://140.116.70.8/img/photo.jpglmemuser-agent:" - Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp") Found URL "http://140.116.70.8/index.asplocal" - Source: "00000000-00005560.00000002.70101.002F0000.00000004.mdmp") Found URL "http://140.116.70.8/img/photo.jpghttp://140.116.70.8/img/photo.jpg://1xv0/4lmemmicrosoft" - Source: "00000000-00005560.00000002.70101.002F0000.00000004.mdmp") Found URL "http://140.116.70.8/img/photo.jpghttp://140.116.70.8/img/photo.jpglmemuser-agent:" - Source: "00000000-00005560.00000002.70101.002F0000.00000004.mdmp") Found URL "http://140.116.70.8/index.asp\device\netbt_tcpip_" - Source: "00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found URL "http://140.116.70.8/img/photo.jpgklmem://10tp://140.116.70.8/img/photo.jpgmicrosoft" - Source: "00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found URL "http://140.116.70.8/img/photo.jpghttp://140.116.70.8/img/photo.jpghttp://140.116.70.8/img/photo.jpguser-agent:" - Source: "00000000-00005560.00000003.77544.002F0000.00000004.mdmp")31:T6e3,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005560.00000000.66255.002F0000.00000004.mdmp") Found string "I+ncalrpc:[OLE4785CBAB0C604B07A33E7CE822D4]" (Indicator: "ncalrpc"; Source: "00000000-00005560.00000000.66255.002F0000.00000004.mdmp, 00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found string "+ncalrpc:[OLEE9A1C67652ED46B88019BB4329C0]" (Indicator: "ncalrpc"; Source: "00000000-00005560.00000000.66255.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found string "+ncalrpc:[OLE4785CBAB0C604B07A33E7CE822D4]" (Indicator: "ncalrpc"; Source: "00000000-00005560.00000000.66255.002F0000.00000004.mdmp, 00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found string "ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found string "+ncalrpc:[OLE1B7BEC4545C6404FBFEC124C8671]" (Indicator: "ncalrpc"; Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp") Found string "A+ncalrpc:[OLEB4k" (Indicator: "ncalrpc"; Source: "00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found string "+ncalrpc:[OLEB47F3FBECEF140729C40AA4F3981]" (Indicator: "ncalrpc"; Source: "00000000-00005560.00000003.77544.002F0000.00000004.mdmp")32:T440,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005560.00000001.68178.00404000.00000002.mdmp")33:T7c6,Found string "\Device\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}" (Indicator: "\Device\"; Source: "00000000-00005560.00000000.66255.002F0000.00000004.mdmp") Found string "\Device\{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00005560.00000000.66255.002F0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip_{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}" (Indicator: "\Device\"; Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}" (Indicator: "\Device\"; Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}" (Indicator: "\Device\"; Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}" (Indicator: "\Device\"; Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp")34:Ta62,"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "")35:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790351431094,"unified_at":"2026-09-25T15:50:31.094Z","metadata":{"hashes":{"sha256":"342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978","sha1":"334a213f1bba4907c94bbd4790d5e427fc6a77a3","md5":"a2cd1189860b9ba214421aab86ecbc8a","sha512":"bf79a149dc86b11d53950056d45ed0870fc3395dcbc5db1f04b4cf555481255f847118c46da86029c39bc14aa4c00146f76692674c0e18f59f02f40c78bbf7ea","ssdeep":"384:C6/eda5k7JPT78gqA87KnXuPlBfnzm1F39PKG:C6md4kNPf8C4KnXeffnUh9P","ssdeep_chunks":["384:C6/eda5","384:6/eda5k","384:/eda5k7","384:eda5k7J","384:da5k7JP","384:a5k7JPT","384:5k7JPT7","384:k7JPT78","384:7JPT78g","384:JPT78gq","384:PT78gqA","384:T78gqA8","384:78gqA87","384:8gqA87K","384:gqA87Kn","384:qA87KnX","384:A87KnXu","384:87KnXuP","384:7KnXuPl","384:KnXuPlB","384:nXuPlBf","384:XuPlBfn","384:uPlBfnz","384:PlBfnzm","384:lBfnzm1","384:Bfnzm1F","384:fnzm1F3","384:nzm1F39","384:zm1F39P","384:m1F39PK","384:1F39PKG","768:C6/eda5","768:6/eda5k","768:/eda5k7","768:eda5k7J","768:da5k7JP","768:a5k7JPT","768:5k7JPT7","768:k7JPT78","768:7JPT78g","768:JPT78gq","768:PT78gqA","768:T78gqA8","768:78gqA87","768:8gqA87K","768:gqA87Kn","768:qA87KnX","768:A87KnXu","768:87KnXuP","768:7KnXuPl","768:KnXuPlB","768:nXuPlBf","768:XuPlBfn","768:uPlBfnz","768:PlBfnzm","768:lBfnzm1","768:Bfnzm1F","768:fnzm1F3","768:nzm1F39","768:zm1F39P","768:m1F39PK","768:1F39PKG","384:C6md4kN","384:6md4kNP","384:md4kNPf","384:d4kNPf8","384:4kNPf8C","384:kNPf8C4","384:NPf8C4K","384:Pf8C4Kn","384:f8C4KnX","384:8C4KnXe","384:C4KnXef","384:4KnXeff","384:KnXeffn","384:nXeffnU","384:XeffnUh","384:effnUh9","384:ffnUh9P"],"imphash":"975afc272795c0937704d4a879d5f49c"},"file_info":{"file_name":"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A","file_type":["peexe","executable"],"file_type_id":"exe","file_size":13824,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1503798510000,"last_seen":1770926001000,"last_multi_scan":1770926001000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["apt","apt1","byzantine","commentpanda","plaunit61398","targeted"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":40},"sandbox_signatures":{"informative_count":87,"suspicious_count":22,"malicious_count":9,"total":118},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/Win32.Small","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/Win32.Small","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1340878","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.437275","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-30695","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.437275 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/TrojanDownloader.Agent.QVC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"TrojanDldr.Small.khk.xafu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/Agent.wh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 00605c1e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/FoxLdr-Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXAI-BA!A2CD1189860B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan-Dlr-SysWrt-based!Max","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Small.KHK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_55.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Small.dy126","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.Small.Win32.19346","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"140.116.70.8:80\"\n \"216.58.213.132:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$22","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/k\" on 2017-8-27.02:41:58.505","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/k\" (UID: 00016760-00002692)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"C:\\Users\\hLlk3uc\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://140.116.70.8/index.asp\"\n Pattern match: \"http://140.116.70.8/img/photo.jpg\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00014255-00002528-00000105-39768045","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/61 reputation engines marked \"http://140.116.70.8\" as malicious (1% detection rate)\n 1/62 reputation engines marked \"http://140.116.70.8/img/photo.jpg\" as malicious (1% detection rate)\n 1/67 reputation engines marked \"http://140.116.70.8/index.asp\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"rasman\" service\n \"\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00014255-00002528-27917-16-00402750\n InternetReadFile@WININET.DLL at 00014255-00002528-27917-18-00402440","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 904)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASAPI32\" (Filter: 14; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASMANCS\" (Filter: 14; Subtree: 0)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"140.116.70.8\"\n Heuristic match: \"http://140.116.70.8/index.asp\"\n Heuristic match: \"http://140.116.70.8/img/photo.jpg\"\n Heuristic match: \"whttp://140.116.70.8/img/photo.jpg\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCloseKey\n CopyFileA\n GetModuleFileNameA\n LoadLibraryA\n GetFileSize\n DeleteFileA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n TerminateProcess\n CreateProcessA\n Sleep\n CreateFileA\n ShellExecuteExA\n HttpSendRequestA\n InternetOpenUrlA\n InternetWriteFile\n InternetCloseHandle\n InternetOpenA\n InternetConnectA\n HttpSendRequestExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"57/64 Antivirus vendors marked sample as malicious (89% detection rate)\n 31/39 Antivirus vendors marked sample as malicious (79% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"57/64 Antivirus vendors marked sample as malicious (89% detection rate)\n 31/39 Antivirus vendors marked sample as malicious (79% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$23","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"thequickbrow_APT1\" classified file \"342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978.exe.bin\" as \"apt,apt1\" based on indicators: \"thequickbrownfxjmpsvalzydg\" (Author: AlienVault Labs)\n YARA signature \"thequickbrow_APT1\" classified process \"342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978.exe\" as \"apt,apt1\" based on indicators: \"thequickbrownfxjmpsvalzydg\" (Author: AlienVault Labs)\n YARA signature \"thequickbrow_APT1\" classified file \"all.bstring\" as \"apt,apt1\" based on indicators: \"thequickbrownfxjmpsvalzydg\" (Author: AlienVault Labs)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to hide a procedure lookup using single characters","description":"Found a lot of single characters ('e','e','e','e','e','W','i','n','i','n','t','I','n','t','r','n','t','R','a','d','F','i','l','D') being pushed to stack and GetProcAddress@KERNEL32.DLL in the same context (relevant concatenated strings: 'rnetReadFile','InternetReadFile') at: 00014255-00002528-27917-2-004014F0","origin":"Hybrid Analysis Technology","relevance":9,"id":"stream-36","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"IsWow64Process\" with parameter \"5560\" - (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$24","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005560)\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"LookupAccountSidW\" with param Name GpDSAQb (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005560)\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005560)\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files (UID: 00000000-00005560)\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00005560)\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00005560)\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\History (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"CreateProcessA\" with parameter \"/k\" - (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"NtCreateNamedPipeFile\" (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$26","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"\\cmd.exe /c\" (Indicator: \"cmd.exe /c\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\n \"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00005560.00000000.66255.002F0000.00000004.mdmp\n 00000000-00005560.00000001.68178.002F0000.00000004.mdmp\n 00000000-00005560.00000002.70101.002F0000.00000004.mdmp\n 00000000-00005560.00000003.77544.002F0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005560.00000001.68178.002F0000.00000004.mdmp\n 00000000-00005560.00000002.70101.002F0000.00000004.mdmp\n 00000000-00005560.00000003.77544.002F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0)\" (Indicator: \"mozilla/4.0 (\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found string \"Mozilla/4.0 (compatible; MSIE 8.0; Win32)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005560-00000C7E-147\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 763B0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 763B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0a000b004ca02875@mswsock.dll\"\n \"0d000e0010947274@wship6.dll\"\n \"0e000f0000947274@wship6.dll\"\n \"0b000c00f4937274@wship6.dll\"\n \"09000a00e8937274@wship6.dll\"\n \"17001800d0937274@wship6.dll\"\n \"17001800b8937274@wship6.dll\"\n \"12001300a4937274@wship6.dll\"\n \"160017008c937274@wship6.dll\"\n \"1700180074937274@wship6.dll\"\n \"1200130060937274@wship6.dll\"\n \"120013004c937274@wship6.dll\"\n \"0800090040937274@wship6.dll\"\n \"08000900dc62bb76@WS2_32.dll\"\n \"0d000e00fcd6966a@IPHLPAPI.DLL\"\n \"0f00100054d7966a@IPHLPAPI.DLL\"\n \"0c000d009cd7966a@IPHLPAPI.DLL\"\n \"150016003cca966a@advapi32.DLL\"\n \"0e000f00ecca966a@advapi32.DLL\"\n \"0e000f0048cb966a@advapi32.DLL\"\n \"1100120024d3966a@advapi32.DLL\"\n \"11001200c0d3966a@advapi32.DLL\"\n \"1200130004d4966a@advapi32.DLL\"\n \"120013005cd4966a@advapi32.DLL\"\n \"14001500ecf3966a@advapi32.DLL\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\")\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\\LOCALSERVER32\")\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\")\n \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" touched \"NetworkListManager\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x404160,push\t0x4031a0,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x68,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,xor\tebx, ebx,mov\tdword ptr [ebp - 4], ebx,push\t2,call\tdword ptr [0x4040ac],pop\tecx,or\tdword ptr [0x4057dc], 0xffffffff,or\tdword ptr [0x4057e0], 0xffffffff,call\tdword ptr [0x4040b0],mov\tecx, dword ptr [0x4057d8],mov\tdword ptr [eax], ecx,call\tdword ptr [0x4040b4],mov\tecx, dword ptr [0x4057d4],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x4040b8],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00005560-00000C40-9805994400771]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/k\" (UID: 00000000-00005880)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Possibly tries to evade analysis by sleeping many times","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: index.asp\" - (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 8.0; Win32)\" (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"19678804155171,5796,3198,,InternetOpenA,Wininet.dll,\"254:17:05.640\",RX=0,PX=0\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")\n Found reference to API \"34974473018899,5796,3198,,InternetOpenA,Wininet.dll,\"255:57:58.028\",RX=0,PX=0\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005560.00000003.77544.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ookie:hapubws@www.gmx.net/\" [Source: 00000000-00005560.00000001.68178.002F0000.00000004.mdmp\n 00000000-00005560.00000002.70101.002F0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found string \"POST index.asp HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005560.00000000.66255.002F0000.00000004.mdmp\")\n Found string \"ST /index.asp HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp\")\n Found string \"GET /img/photo.jpg HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp\")\n Found string \"T /img/photo.jpg HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005560.00000001.68178.002F0000.00000004.mdmp, 00000000-00005560.00000002.70101.002F0000.00000004.mdmp, 00000000-00005560.00000003.77544.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 140e0f0cad708278ade0984528fe8493","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$33","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005560.00000001.68178.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00005560.00000000.66255.002F0000.00000004.mdmp\n 00000000-00005560.00000003.77544.002F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" (Thread ID: 5724) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"hapubws@wayfair.com\"\n Pattern match: \"hapubws@same.eastmoney.com\"\n Pattern match: \"hapubws@gateway.foresee.com\"\n Pattern match: \"hapubws@jalan.net\"\n Pattern match: \"hapubws@nextag.com\"\n Pattern match: \"hapubws@www.rakuten.co.jp\"\n Pattern match: \"hapubws@milliyet.com.tr\"\n Pattern match: \"hapubws@www.reuters.com\"\n Pattern match: \"hapubws@www.toysrus.com\"\n Pattern match: \"hapubws@myvisualiq.net\"\n Pattern match: \"hapubws@volvelle.tech\"\n Pattern match: \"hapubws@makepolo.com\"\n Pattern match: \"hapubws@j.mrpdata.net\"\n Pattern match: \"hapubws@commander1.com\"\n Pattern match: \"hapubws@sync.shinobi.jp\"\n Pattern match: \"hapubws@www.match.com\"\n Pattern match: \"hapubws@advertising.com\"\n Pattern match: \"hapubws@hubstatic.com\"\n Pattern match: \"hapubws@travelzoo.com\"\n Pattern match: \"hapubws@moviefone.com\"\n Pattern match: \"hapubws@districtm.io\"\n Pattern match: \"hapubws@www.bing.com\"\n Pattern match: \"hapubws@piriform.com\"\n Pattern match: \"hapubws@www.instagram.com\"\n Pattern match: \"hapubws@addictinggames.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 140.116.70.8 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"ping 0, GenuineIntel\" (Indicator: \"ping\"; Source: \"00000000-00005560.00000000.66255.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\" allocated memory in \"C:\\NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":26,"imported_dlls_count":75,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["apt","apt1","byzantine","commentpanda","plaunit61398","targeted"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"658455479009d354da06fd52","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"TrojanDownloader.Small","contacted_countries":["TWN"],"submit_name":"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A","analysis_start_time":"2023-12-21T15:11:14+00:00","indicators_count":{"informative":91,"suspicious":21,"malicious":5},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"59a223147ca3e15c7b027149","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"TrojanDownloader.Small","contacted_countries":["TWN","USA"],"submit_name":"NEWSREELS_sample_A2CD1189860B9BA214421AAB86ECBC8A","analysis_start_time":"2017-08-27T02:39:16+00:00","indicators_count":{"informative":8,"suspicious":18,"malicious":7},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"140.116.70.8","port":80,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"address":"216.58.213.132","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}],"processes":[{"pid":2528,"ppid":0,"name":"342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978.exe","command_line":"","sha256":"342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978","normalized_path":"C:\\342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978.exe","uid":"00014255-00002528","icon":"$35"},{"pid":2692,"ppid":2528,"name":"cmd.exe","command_line":"/k","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014255-00002528","uid":"00016760-00002692","icon":"$36"}],"all_imported_dlls":["lpk.dll","rpcrt4.dll","msasn1.dll","dnsapi.dll","msvcrt.dll","crypt32.dll","comctl32.dll","winnsi.dll","ntdll.dll","imm32.dll","ntmarta.dll","rasapi32.dll","rasadhlp.dll","npmproxy.dll","oleaut32.dll","msctf.dll","nsi.dll","NapiNSP.dll","pnrpnsp.dll","wship6.dll","ole32.dll","rsaenh.dll","dhcpcsvc.dll","sechost.dll","profapi.dll","IPHLPAPI.DLL","user32.dll","gdi32.dll","advapi32.dll","Wldap32.dll","WSHTCPIP.DLL","shell32.dll","shlwapi.dll","sspicli.dll","usp10.dll","rasman.dll","rtutils.dll","RpcRtRemote.dll","apphelp.dll","ws2_32.dll","kernel32.dll","KernelBase.dll","wininet.dll","mswsock.dll","iertutil.dll","SensApi.dll","winbrand.dll","nlaapi.dll","cryptbase.dll","rpcss.dll","clbcatq.dll","cryptsp.dll","dhcpcsvc6.dll","urlmon.dll","winrnr.dll","FWPUCLNT.DLL","netprofm.dll","fltLib.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","userenv.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","webio.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","normaliz.dll","winhttp.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","secur32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","version.dll","VxSSL32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wshqos.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{C6782333-3E9C-4B19-98E2-28FBFCACFF57}\\","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{C6782333-3E9C-4B19-98E2-28FBFCACFF57}\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{C6782333-3E9C-4B19-98E2-28FBFCACFF57}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-10-DB-FF-DC-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"name":"Local\\c:!users!hllk3uc!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"Local\\c:!users!hllk3uc!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"Local\\c:!users!hllk3uc!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hllk3uc!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hllk3uc!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hllk3uc!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a223147ca3e15c7b027149"},{"report_type":"sandbox","report_id":"658455479009d354da06fd52"}]}]}},"report_ids":{"sandbox_job_ids":["658455479009d354da06fd52","59a223147ca3e15c7b027149"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Zusy.Generic Sample 342f9acdb9b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 342f9acdb9b8…. Malware family: Zusy.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample 342f9acdb9b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 342f9acdb9b8…. Malware family: Zusy.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/342f9acdb9b89e963761fea283daccf0c7cacaf513a46fd09d9cc89223b9d978"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample 342f9acdb9b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 342f9acdb9b8…. Malware family: Zusy.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]]