26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T49a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.Cerber Sample 35a9ffbbe20f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 35a9ffbbe20f…. Malware family: Trojan.Ransom.Cerber. Threat score 100/100. 23/28 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/35a9ffbbe20f8d4ed483916e15052df53714b7d5fb57fa0326cd0b138c4b73a6","keywords":["Malicious","Trojan.Ransom.Cerber","malware analysis","sandbox report","threat intelligence","35a9ffbbe20f8d4ed483916e15052df53714b7d5fb57fa0326cd0b138c4b73a6"],"about":{"@type":"SoftwareApplication","name":"okp987g7v","applicationCategory":["peexe","executable"],"identifier":"35a9ffbbe20f8d4ed483916e15052df53714b7d5fb57fa0326cd0b138c4b73a6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.Cerber","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T51e,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "DsRoleFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "DsRoleFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp")28:T44a,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp")29:T108c,Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptSetKeyParam" (Indicator: "CryptSetKeyParam"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptSetHashParam" (Indicator: "CryptSetHashParam"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptGetKeyParam" (Indicator: "CryptGetKeyParam"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found api reference "CryptSetKeyParam" (Indicator: "CryptSetKeyParam"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found api reference "CryptSetHashParam" (Indicator: "CryptSetHashParam"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp")2a:T44e,Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp")2b:T775,"" (Indicator: "GetDC"; Source: "00000000-00003780.00000000.170061.006A0000.00000004.mdmp, 00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003780.00000000.170061.006A0000.00000004.mdmp, 00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003780.00000000.170061.006A0000.00000004.mdmp, 00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003780.00000000.170061.006A0000.00000004.mdmp, 00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003780.00000000.170061.006A0000.00000004.mdmp, 00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003780.00000000.170061.006A0000.00000004.mdmp, 00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003780.00000000.170061.006A0000.00000004.mdmp, 00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003780.00000000.170061.006A0000.00000004.mdmp, 00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp")35:T6d4,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp")36:T7f6,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "35a9ffbbe20f8d4ed483916e15052df53714b7d5fb57fa0326cd0b138c4b73a6.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp")37:Tf06,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "MapGenericMask" (Indicator: "MapGenericMask"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "MapGenericMask" (Indicator: "MapGenericMask"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00005580.00000000.170730.00400000.00000040.mdmp")38:T434,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003780.00000000.170061.006A0000.00000004.mdmp, 00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005580.00000000.170730.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003780.00000001.171982.006A0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003780.00000003.179407.006A0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005580.00000000.170730.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003780.00000000.170061.006A0000.00000004.mdmp, 00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"/.pm\"\n Heuristic match: \"w2<.yt\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$33","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005580.00000000.170730.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on process \"00000000-00005580\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExA\" in \"00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp\"\n Found registry query API: \"RegOpenKeyExA\" in \"00000000-00005580.00000000.170730.00400000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005580.00000000.170730.00400000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005580.00000000.170730.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00003780.00000001.171982.006A0000.00000004.mdmp, 00000000-00003780.00000003.179407.006A0000.00000004.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005580.00000000.170730.00400000.00000040.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005580.00000000.170730.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a028e22221530becd095845"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"