26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Babar.Generic Sample 36937e5e7448… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 36937e5e7448…. Malware family: Babar.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2","keywords":["Malicious","Babar.Generic","malware analysis","sandbox report","threat intelligence","36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Babar.Generic","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T573,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Users\G3JBw8v\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\rsaenh.dll" "svchost.exe" touched file "C:\Windows\System32\en-US\svchost.exe.mui" "svchost.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "svchost.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uyuibas.exe" "svchost.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uyuibas.exe:Zone.Identifier" "svchost.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\uyuibas.exe:Zone.Identifier"28:T604,"" wrote 32 bytes to a remote process "C:\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe" (Handle: 344) "" wrote 52 bytes to a remote process "C:\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe" (Handle: 344) "" wrote 4 bytes to a remote process "C:\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe" (Handle: 344) "" wrote 1024 bytes to a remote process "C:\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe" (Handle: 344) "" wrote 8192 bytes to a remote process "C:\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe" (Handle: 344) "" wrote 3072 bytes to a remote process "C:\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe" (Handle: 344) "" wrote 512 bytes to a remote process "C:\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe" (Handle: 344) "" wrote 1536 bytes to a remote process "C:\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe" (Handle: 344) "" wrote 32 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 132) "" wrote 52 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 132) "" wrote 4 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 132) "" wrote 28672 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 132)29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMQAAAAAAAAAAAAAAAAAAEzMwAAAAAAAAAAAAAAAAAzMzMwAAAAAAAAAAAAAAADMzMzMwAAAAAAAAAAAAAAMzMzMzMwAAAAAAAAAAAAAzMzMzMzMwAAAAAAAAAAAAMzu7uzMzMwAAAAAAAAAAAAM7O7uzMzMwAAAAAAAAAAAAM7u7u7MzMwAAAAAAAAAAAAM7O7u7MzMwAAAAAAAAAAAAM7u7u7MzMwAAAAAAAAAAAAM7O7u7MzMwAAAAAAAAAAAAM7u7u7szMwAAAAAAAAAAAAM7O7u7uzMwAAAAAAAAAAAAM7u7u7uzMwAAAAAAAAAAAAM7O7u7uzMwAAAAAAAAAAAAM7u7u7uzMwAAAAAAAAAAAAM7O7u7uzMwAAAAAAAAAAAAM7u7u7uzMwAAAAAAAAAAAAM7O7u7uzMwAAAAAAAAAAAAM7u7u7uzMAAAAAAAAAAAAAO7O7u7uzMAAAAAAAAAAAADM7u7u7uzMAAAAAAAAAAAADO7O7u7szAAAAAAAAAAAAADM7u7uzMAAAAAAAAAAAAAADO7O7MwAAAAAAAAAAAAAAADM7szAAAAAAAAAAAAAAAAADOzMAAAAAAAAAAAAAAAAAADMwAAAAAAAAAAAAAAAAAAAAAAAAD4D///AAD//wAA//8AAP//wAH///AH///gA///wAH//8AA///gAH//8AA///gAH//8AA///gAH//8AA///gAH//8AA///gAH//8AA///gAH//8AA///gAH//8AB///gAP//4AB///AAf//4AP///AH///4D////B////4//////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790461165429,"unified_at":"2026-09-26T22:19:25.429Z","metadata":{"hashes":{"sha256":"36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2","sha1":"ded83a1e3b6630d69077976cc01321fbc946dce2","md5":"88f7cfb905f252409925e721668bbfe9","sha512":"a9839808b35c2c1afa986824e1119663dff5e88192d95f47398e7a88daa481c087b57b14d228a362930c977e0ba541c10b8ffa0fbb3bacf7108344f7482a9d62","ssdeep":"1536:0oAs868MBX80Stmv8oXJOJtqgvx7EbPjY5gHL/S8P6unn83c18v0Chu90NH:LAsj8MBX8s0oXJo0gvuf8grBPpa88sxq","ssdeep_chunks":["1536:0oAs868","1536:oAs868M","1536:As868MB","1536:s868MBX","1536:868MBX8","1536:68MBX80","1536:8MBX80S","1536:MBX80St","1536:BX80Stm","1536:X80Stmv","1536:80Stmv8","1536:0Stmv8o","1536:Stmv8oX","1536:tmv8oXJ","1536:mv8oXJO","1536:v8oXJOJ","1536:8oXJOJt","1536:oXJOJtq","1536:XJOJtqg","1536:JOJtqgv","1536:OJtqgvx","1536:Jtqgvx7","1536:tqgvx7E","1536:qgvx7Eb","1536:gvx7EbP","1536:vx7EbPj","1536:x7EbPjY","1536:7EbPjY5","1536:EbPjY5g","1536:bPjY5gH","1536:PjY5gHL","1536:jY5gHL/","1536:Y5gHL/S","1536:5gHL/S8","1536:gHL/S8P","1536:HL/S8P6","1536:L/S8P6u","1536:/S8P6un","1536:S8P6unn","1536:8P6unn8","1536:P6unn83","1536:6unn83c","1536:unn83c1","1536:nn83c18","1536:n83c18v","1536:83c18v0","1536:3c18v0C","1536:c18v0Ch","1536:18v0Chu","1536:8v0Chu9","1536:v0Chu90","1536:0Chu90N","1536:Chu90NH","3072:0oAs868","3072:oAs868M","3072:As868MB","3072:s868MBX","3072:868MBX8","3072:68MBX80","3072:8MBX80S","3072:MBX80St","3072:BX80Stm","3072:X80Stmv","3072:80Stmv8","3072:0Stmv8o","3072:Stmv8oX","3072:tmv8oXJ","3072:mv8oXJO","3072:v8oXJOJ","3072:8oXJOJt","3072:oXJOJtq","3072:XJOJtqg","3072:JOJtqgv","3072:OJtqgvx","3072:Jtqgvx7","3072:tqgvx7E","3072:qgvx7Eb","3072:gvx7EbP","3072:vx7EbPj","3072:x7EbPjY","3072:7EbPjY5","3072:EbPjY5g","3072:bPjY5gH","3072:PjY5gHL","3072:jY5gHL/","3072:Y5gHL/S","3072:5gHL/S8","3072:gHL/S8P","3072:HL/S8P6","3072:L/S8P6u","3072:/S8P6un","3072:S8P6unn","3072:8P6unn8","3072:P6unn83","3072:6unn83c","3072:unn83c1","3072:nn83c18","3072:n83c18v","3072:83c18v0","3072:3c18v0C","3072:c18v0Ch","3072:18v0Chu","3072:8v0Chu9","3072:v0Chu90","3072:0Chu90N","3072:Chu90NH","1536:LAsj8MB","1536:Asj8MBX","1536:sj8MBX8","1536:j8MBX8s","1536:8MBX8s0","1536:MBX8s0o","1536:BX8s0oX","1536:X8s0oXJ","1536:8s0oXJo","1536:s0oXJo0","1536:0oXJo0g","1536:oXJo0gv","1536:XJo0gvu","1536:Jo0gvuf","1536:o0gvuf8","1536:0gvuf8g","1536:gvuf8gr","1536:vuf8grB","1536:uf8grBP","1536:f8grBPp","1536:8grBPpa","1536:grBPpa8","1536:rBPpa88","1536:BPpa88s","1536:Ppa88sx","1536:pa88sxq"],"imphash":"59a4a44a250c4cf4f2d9de2b3fe5d95f"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":111004,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1533117777000,"last_seen":1676621839000,"last_multi_scan":1676621839000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agentorm","anunak","banker","banload","bunitu","carbanak","carberp","carbonspider","critroni","crowti","dafterdod","dodiw","fareit","fin7","glupteba","ransomware","targetedcrimeware"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":15,"suspicious_count":13,"malicious_count":7,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.MDA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1224850","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Babar.38754","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Carbanak.XVKF-9118","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Babar.38754 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Agent.ORM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.efhcfl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Cerber-Z","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject2.ZE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Onion.Win32.403","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Babar.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00023820-00002828-4742-7-00405D13\n GetVersionExA@KERNEL32.DLL at 13488-566-0040DD48","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00023820-00002828-4742-75-0040442A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\nsrBB02.tmp\"\n \"\" created file \"%TEMP%\\l10n.gentext.use.xref.language.xml\"\n \"\" created file \"%TEMP%\\redirection.config\"\n \"\" created file \"%TEMP%\\ParapetApraxiaDriftpin\"\n \"\" created file \"%TEMP%\\nb.pak\"\n \"\" created file \"%TEMP%\\CircleSubpicture.png\"\n \"\" created file \"%TEMP%\\tweakNetworkingManual_tr.p5p\"\n \"\" created file \"%TEMP%\\history_report_blue.png\"\n \"\" created file \"%TEMP%\\network.png\"\n \"\" created file \"%TEMP%\\marble.dll\"\n \"\" created file \"%TEMP%\\nsmFA44.tmp\\System.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\phil337c43174b33\"\n \"Global\\phil337c43174b33\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00026035-00002620)\n Spawned process \"svchost.exe\" with commandline \"-k netsvcs\" (UID: 00027850-00003156)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"\" (UID: 00026035-00002620)\n Spawned process \"svchost.exe\" with commandline \"-k netsvcs\" (UID: 00027850-00003156)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"marble.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows\"\n \"l10n.gentext.use.xref.language.xml\" has type \"HTML document ASCII text\"\n \"network.png\" has type \"PNG image data 32 x 32 8-bit/color RGBA non-interlaced\"\n \"redirection.config\" has type \"ASCII text with CRLF line terminators\"\n \"nb.pak\" has type \"data\"\n \"history_report_blue.png\" has type \"PNG image data 24 x 24 8-bit/color RGBA non-interlaced\"\n \"ParapetApraxiaDriftpin\" has type \"data\"\n \"tweakNetworkingManual_tr.p5p\" has type \"UTF-8 Unicode text with very long lines\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"Installation/Persistance","name":"Writes to a start menu file","description":"\"svchost.exe\" wrote 65536 bytes to file \"%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\STARTUP\\UYUIBAS.EXE\" (Byte Offset: 0): MZ�\n \"svchost.exe\" wrote 45468 bytes to file \"%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\STARTUP\\UYUIBAS.EXE\" (Byte Offset: 65536): ��\n \"svchost.exe\" wrote 26 bytes to file \"%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\STARTUP\\UYUIBAS.EXE:ZONE.IDENTIFIER\" (Byte Offset: 0): [ZoneTransfer]ZoneId=1","origin":"API Call","relevance":3,"id":"api-53","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Pattern match: \"http://docbook.org/ns/docbook\"\n Pattern match: \"http://www.w3.org/1999/xlink\"\n Pattern match: \"http://www.w3.org/2001/XInclude\"\n Pattern match: \"http://nwalsh.com/xmlns/litprog/fragment\"\n Pattern match: \"http://www.w3.org/1999/XSL/Transform\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"svchost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe.bin\" was detected as \"Nullsoft PiMP Stub -> SFX\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"svchost.exe\" created file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuibas.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00026035-00002620-00000105-75853829861","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"C:\\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe\", Handle: 344)\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\svchost.exe\", Handle: 132)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"marble.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00023820-00002828-4742-84-0040511A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe\" marked \"%TEMP%\\nstBACF.tmp\" for deletion\n \"C:\\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe\" marked \"%TEMP%\\nsmFA44.tmp\" for deletion\n \"C:\\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe\" marked \"%TEMP%\\nsmFA44.tmp\\System.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\nstBACF.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsmFA44.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsmFA44.tmp\\System.dll\" with delete access\n \"\" opened \"%TEMP%\\nsmFA44.tmp\\\" with delete access\n \"svchost.exe\" opened \"C:\\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n RegOpenKeyExA\n RegDeleteValueA\n RegCreateKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteA\n FindWindowExA\n VirtualProtect\n VirtualAlloc\n GetVersionExA\n GetStartupInfoA\n UnhandledExceptionFilter\n GetThreadContext","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"0857b2750478bb750000000051c19b7594989b75ee9c9b7575dc9d75273e9d75efb2a1750000000046ceb876013db97638edb976cfcdb8763123b876de2fb976c4cab87680bbb876aa6eb9769fbbb87692bbb87646bab8760abfb87600000000\" to virtual address \"0x73611000\" (part of module \"SHFOLDER.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"52/68 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"52/68 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"51/68 Antivirus vendors marked dropped file \"marble.dll\" as malicious (classified as \"Trojan.Injector\" with 75% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"52/68 Antivirus vendors marked spawned process \"\" (PID: 2620) as malicious (classified as \"Trojan.Generic\" with 76% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$28","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00023820-00002828-4742-1-00403217","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":45,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":25,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agentorm","anunak","banker","banload","bunitu","carbanak","carberp","carbonspider","critroni","crowti","dafterdod","dodiw","fareit","fin7","glupteba","ransomware","targetedcrimeware"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5b6185507ca3e160e87510a3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe","analysis_start_time":"2018-08-01T12:03:09+00:00","indicators_count":{"informative":15,"suspicious":15,"malicious":10},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}],"processes":[{"pid":2828,"ppid":0,"name":"36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe","command_line":"","sha256":"36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2","normalized_path":"C:\\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe","uid":"00023820-00002828","icon":"$29"},{"pid":2620,"ppid":2828,"name":"36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe","command_line":"","sha256":"36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2","normalized_path":"C:\\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe","parent_uid":"00023820-00002828","uid":"00026035-00002620"},{"pid":3156,"ppid":2620,"name":"svchost.exe","command_line":"-k netsvcs","sha256":"121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00026035-00002620","uid":"00027850-00003156"}],"all_imported_dlls":["kernel32.dll","KernelBase.dll","advapi32.dll","rpcrt4.dll","cfgmgr32.dll","winnsi.dll","msasn1.dll","iertutil.dll","lpk.dll","version.dll","Wldap32.dll","System.dll","apphelp.dll","crypt32.dll","GdiPlus.dll","ntdll.dll","ole32.dll","setupapi.dll","devobj.dll","clbcatq.dll","gdi32.dll","shell32.dll","imm32.dll","cryptbase.dll","propsys.dll","IPHLPAPI.DLL","dhcpcsvc.dll","user32.dll","usp10.dll","shfolder.dll","cryptsp.dll","comctl32.dll","uxtheme.dll","nsi.dll","ws2_32.dll","rsaenh.dll","sechost.dll","msctf.dll","ntmarta.dll","profapi.dll","wininet.dll","urlmon.dll","msvcrt.dll","shlwapi.dll","oleaut32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"marble.dll","sha256":"f70d62b889b6c3a19736bb8f58f2f9097ce131247ebe89d70559cd67912d9291","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"name":"System.dll","sha256":"44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"name":"ParapetApraxiaDriftpin","sha256":"36ed03e93b56003d74430d0b5f0f9d8128815a888ba06ab7c58d4977f026bdc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"name":"history_report_blue.png","sha256":"89762a04252156c0c4e118e9a3c8b0955044b410f0f42a7fe0610a8c8d098ac9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"name":"l10n.gentext.use.xref.language.xml","sha256":"ccb4deef7c72470b87bfc1c7a7bf262cb388eb8916ee3a7ae51a6163c6ae07e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"name":"nb.pak","sha256":"0e1624d1e9c276bcbcc7e925e197f3fc3d49bd6407ba2f243bae6d085cc78493","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"name":"network.png","sha256":"e8713dd76c089f078e46fb61d32fba1a0789a378d22b2d14c64f1a9ed62fee77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"name":"redirection.config","sha256":"fc14cf7ed10df61cd9e94d530796b9c6e5f89b09ac977f42a2a496950a3da6db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"name":"tweakNetworkingManual_tr.p5p","sha256":"fb22bfc8ae5d740adca019aa72f31ecfe4ba961f1398b4187e95eb35b59228d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%TEMP%\\nsrBB02.tmp","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"C:\\Users\\G3JBw8v","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%TEMP%\\l10n.gentext.use.xref.language.xml","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%TEMP%\\redirection.config","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%TEMP%\\ParapetApraxiaDriftpin","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%TEMP%\\nb.pak","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%TEMP%\\CircleSubpicture.png","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%TEMP%\\tweakNetworkingManual_tr.p5p","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%TEMP%\\history_report_blue.png","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%TEMP%\\network.png","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%TEMP%\\marble.dll","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%WINDIR%\\System32\\en-US\\svchost.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"C:\\36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuibas.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SESSION MANAGER\\","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\phil337c43174b33","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]},{"name":"Global\\phil337c43174b33","sources":[{"report_type":"sandbox","report_id":"5b6185507ca3e160e87510a3"}]}]}},"report_ids":{"sandbox_job_ids":["5b6185507ca3e160e87510a3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Babar.Generic Sample 36937e5e7448… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 36937e5e7448…. Malware family: Babar.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2"}],["$","meta","4",{"property":"og:title","content":"Malicious Babar.Generic Sample 36937e5e7448… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 36937e5e7448…. Malware family: Babar.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/36937e5e744873b3646c9d345e8cf50fb969029dc77525acfe63d5a9d28b73f2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Babar.Generic Sample 36937e5e7448… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 36937e5e7448…. Malware family: Babar.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]