26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware_60.0 Sample 3c679cbf1597… — Score 76/100 — Hybrid Analysis","description":"Malicious verdict for sample 3c679cbf1597…. Malware family: Malware_60.0. Threat score 76/100. 1/25 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","keywords":["Malicious","Malware_60.0","malware analysis","sandbox report","threat intelligence","3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f"],"about":{"@type":"SoftwareApplication","name":"MoonasBakery-v2.0.0.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","additionalType":"Malicious sample"},"threatScore":76,"malwareFamily":"Malware_60.0","antivirusDetections":{"malicious":1,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T34f0,Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetStockObject"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "IsIconic"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "FlushInstructionCache"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "Module32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterClassA"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCapture"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseCapture"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetTextExtentPoint32A"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateGuid"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAllocEx"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetAsyncKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "GetCapture"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "WriteProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorA"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "RegGetValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileSectionW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFreeEx"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "SHCreateDirectoryExW"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassExA"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "TextOutA"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpSetTimeouts"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptCreateHash"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "SetMapMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetTextMetricsA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeThread"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileSectionW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteA"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "Module32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontA"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "SetStretchBltMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "SetRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "IsRectEmpty"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "ClientToScreen"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "PtInRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptHashData"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSolidBrush"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpReadData"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptFinishHash"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "RoundRect"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "FindWindowA"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDestroyHash"; Source: "sample.bin"), Found reference to API (Indicator: "KillTimer"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CreateRemoteThread"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "sample.bin")28:T429,Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "sample.bin"), Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "sample.bin"), Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "sample.bin"), Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "sample.bin"), Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "sample.bin"), Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "sample.bin"), Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "sample.bin")29:T74a,"MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\COMPATIBILITY\MOONASBAKERY-V2.0.0.EXE") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\OOBE") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\OOBE") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK")2a:T593,Contains base64 string in header "POST" in header "POST /r HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: MoonasBakery/2.0.0Content-Length: 57Host: bakery.moonasbakery.com" Contains base64 string in header "Keep" in header "POST /r HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: MoonasBakery/2.0.0Content-Length: 57Host: bakery.moonasbakery.com" Contains base64 string in header "AliveContent" in header "POST /r HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: MoonasBakery/2.0.0Content-Length: 57Host: bakery.moonasbakery.com" Contains base64 string in header "Type" in header "POST /r HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: MoonasBakery/2.0.0Content-Length: 57Host: bakery.moonasbakery.com" Contains base64 string in header "application/jsonUser" in header "POST /r HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: MoonasBakery/2.0.0Content-Length: 57Host: bakery.moonasbakery.com" Contains base64 string in header "0Content" in header "POST /r HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: MoonasBakery/2.0.0Content-Length: 57Host: bakery.moonasbakery.com" Contains base64 string in header "moonasbakery" in header "POST /r HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: MoonasBakery/2.0.0Content-Length: 57Host: bakery.moonasbakery.com"2b:T42d,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm2c:Ta0a,"MoonasBakery-v2.0.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006516) "MoonasBakery-v2.0.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000a003a210d701000064f07f052c0000000d000000030000004db43354fd7f00000000a210d7010000a85e3754fd7f000000000000000000009e3d104ffd7f00009803a210d7010000a4f07f052c000000d0caa210d7010000c0caa210d70100000000000000000000343d104ffd7f0000d0caa210d7010000d0caa210d7010000d0caa210d7010000000000000000000000000000000000003ba3e351fd7f00000000000000000000a85e3754fd7f000020f27f052c00000040127a10d701000020000000000000000000000000000000d00000000000000040127a10d70100000000000000000000409d9352fd7f000000000000 (UID: 00000000-00006516) "MoonasBakery-v2.0.0.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006516) "MoonasBakery-v2.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006516)2d:T565,"MoonasBakery-v2.0.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "MoonasBakery-v2.0.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "MoonasBakery-v2.0.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "MoonasBakery-v2.0.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "MoonasBakery-v2.0.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "MoonasBakery-v2.0.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "MoonasBakery-v2.0.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "MoonasBakery-v2.0.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "MoonasBakery-v2.0.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "MoonasBakery-v2.0.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")2e:T7a2,"MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd28810000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd4f340000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ffd45f90000 "MoonasBakery-v2.0.0.exe" loaded module "WINHTTP.DLL" at base 7ffd4b8d0000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffd350a0000 "MoonasBakery-v2.0.0.exe" loaded module "RPCRT4.DLL" at base 7ffd53100000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffd51050000 "MoonasBakery-v2.0.0.exe" loaded module "KERNEL32.DLL" at base 7ffd527e0000 "MoonasBakery-v2.0.0.exe" loaded module "SSPICLI.DLL" at base 7ffd51830000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffd48040000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffd48a60000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffd50880000 "MoonasBakery-v2.0.0.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffd43160000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffd42e20000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd51d40000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd50970000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffd53280000 "MoonasBakery-v2.0.0.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffd525d0000 "MoonasBakery-v2.0.0.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffd525d0000 "MoonasBakery-v2.0.0.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffd529c0000 "MoonasBakery-v2.0.0.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffd523c00002f:T512,"MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: ""; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS\DNSCACHE"; Key: ""; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\LANGUAGEOVERLAY\OVERLAYPACKAGES\EN-US"; Key: ""; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: ""; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS"; Key: ""; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")30:Td2e,"MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SECUREAUTOPROXY"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SENDDNSTOHOST"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: "ENABLETLSEXTERNALALGORITHMS"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SCHANNEL"; Key: "USERCONTEXTLOCKCOUNT"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SCHANNEL"; Key: "USERCONTEXTLISTCOUNT"; Value: "")31:T417,"MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\dwmapi.dll" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\WINHTTP.dll" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\MSVCP140.dll" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\WindowsCodecs.dll" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\webio.dll" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\winnlsres.dll" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\SspiCli.dll" "MoonasBakery-v2.0.0.exe" trying to access non-existent file "C:\TextShaping.dll"32:Tb1be,Found URL "https://bakery.moonasbakery.com/bakery.moonasbakery.comystemaginystem32\wind=ata\local\micalrpctsvcsku2ucalrpcpmappercalrpcpmappersasspirpcerberossasspirpcdigestcalrpcegotiatechannelredssppmapperpmapperredssp.dllpmappersssploudapcalrpc4809900548,3" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "https://bakery.moonasbakery.com/rbakery.moonasbakery.combakery.moonasbakery.comsecp384r1ecdsacryptoidinfoeccparameterswtls7ecdsacryptoidinfoeccparametersnistp384ecdhcryptoidinfoeccparameterssecp384r1ecdhcryptoidinfoeccparametersnistp192ecdhcryptoidinfoeccparameterswtls7ecdhcryptoidinfoeccparametersnistp521ecdhcryptoidinfoeccparameterssecp224r1ecdsacryptoidinfoeccparametersnistp224ecdsacryptoidinfoeccparametersnistp224ecdhcryptoidinfoeccparameterssecp160r1ecdhcryptoidinfoeccparameterssecp160r2ecdsacryptoidinfoeccparametersnistp256ecdhcryptoidinfoeccparameterssecp160k1ecdsacryptoidinfoeccparameterssecp224k1ecdhcryptoidinfoeccparameterssecp224k1ecdsacryptoidinfoeccparameterssecp521r1ecdsacryptoidinfoeccparameterssecp521r1ecdhcryptoidinfoeccparameterssecp160k1ecdhcryptoidinfoeccparametersnistp384ecdsacryptoidinfoeccparameterssecp160r1ecdsacryptoidinfoeccparameterssecp224r1ecdhcryptoidinfoeccparameterssecp192k1ecdsacryptoidinfoeccparameterssecp192k1ecdhcryptoidinfoeccparameterssecp256k1ecdsacryptoidinfoeccparameterssecp256k1ecdhcryptoidinfoeccparametersnistp521ecdsacryptoidinfoeccparameterssecp160r2ecdhcryptoidinfoeccparameterspc-394ba1244043eey" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "https://bakery.moonasbakery.com/rmoonasbakery/2.0.0content-typeapplication/jsonacmgs" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0tkdq$i67ssvfh&8smicrosoft" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0tkdq$i67ssvfedu!$kqu" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=idwftortug%2fgjytjzq2rasz1ul9dad%2b1q4olijf2jboomacnwadvfdxwaaffoop3h71lnmoefkkwowhxxxha67b5gttzpmmlir0mm9dx08ytn98obn%2bvlfncyp%2bbjtvjwfdyztdkutk16g%3d%3d" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0tkdq$i67ssvf@'" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0tkdq$i67ssvfquuuassmquuuassmquuuassmquuuassmquuuassmassmassm3lssruuu" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigiih" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwashington1redmond1microsoft" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3.,t+.1.248.01153941.9.1..6.2sersceietperuqseetcndoee.1.248.01153941.9.1..6.211xehcrpfereneecneocedxe.1.248.01153941.9.1..6.221sessgicnreitifacetneocedxe.1.248.01153941.9.1..6.2sesscerutilybaleneocedxe.1.248.01153941.9.1..6.2semshlsiotyrneocedxe.1.248.01153941.9.1..6.2secsnoettnihtnneocedxenedc1q;j;cm[0" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=idwftortug%2fgjytjzq2rasz1ul9dad%2b1q4olijf2jboomacnwadvfdxwaaffoop3h71lnmoefkkwowhxxxha67b5gttzpmmlir0mm9dx08ytn98obn%2bvlfncyp%2bbjtvjwfdyztdkutk16g%3d%3d" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!alt-svch3=" - Source: "00000000-00006516.00000000.297976.13770000.00000004.mdmp") Found URL "https://bakery.moonasbakery.com/bakery.moonasbakery.comystemaginystem32\wind=ata\local\micalrpctsvcsku2ucalrpcpmappercalrpcpmappersasspirpcerberossasspirpcdigestcalrpcegotiatechannelredssppmapperpmapperredssp.dllpmappersssploudapcalrpc4809900548,3" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "https://bakery.moonasbakery.com/rbakery.moonasbakery.combakery.moonasbakery.comsecp384r1ecdsacryptoidinfoeccparameterswtls7ecdsacryptoidinfoeccparametersnistp384ecdhcryptoidinfoeccparameterssecp384r1ecdhcryptoidinfoeccparametersnistp192ecdhcryptoidinfoeccparameterswtls7ecdhcryptoidinfoeccparametersnistp521ecdhcryptoidinfoeccparameterssecp224r1ecdsacryptoidinfoeccparametersnistp224ecdsacryptoidinfoeccparametersnistp224ecdhcryptoidinfoeccparameterssecp160r1ecdhcryptoidinfoeccparameterssecp160r2ecdsacryptoidinfoeccparametersnistp256ecdhcryptoidinfoeccparameterssecp160k1ecdsacryptoidinfoeccparameterssecp224k1ecdhcryptoidinfoeccparameterssecp224k1ecdsacryptoidinfoeccparameterssecp521r1ecdsacryptoidinfoeccparameterssecp521r1ecdhcryptoidinfoeccparameterssecp160k1ecdhcryptoidinfoeccparametersnistp384ecdsacryptoidinfoeccparameterssecp160r1ecdsacryptoidinfoeccparameterssecp224r1ecdhcryptoidinfoeccparameterssecp192k1ecdsacryptoidinfoeccparameterssecp192k1ecdhcryptoidinfoeccparameterssecp256k1ecdsacryptoidinfoeccparameterssecp256k1ecdhcryptoidinfoeccparametersnistp521ecdsacryptoidinfoeccparameterssecp160r2ecdhcryptoidinfoeccparameterspc-394ba1244043eey" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "https://bakery.moonasbakery.com/rmoonasbakery/2.0.0content-typeapplication/jsonacmgs" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0tkdq$i67ssvfh&8smicrosoft" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0tkdq$i67ssvfedu!$kqu" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=idwftortug%2fgjytjzq2rasz1ul9dad%2b1q4olijf2jboomacnwadvfdxwaaffoop3h71lnmoefkkwowhxxxha67b5gttzpmmlir0mm9dx08ytn98obn%2bvlfncyp%2bbjtvjwfdyztdkutk16g%3d%3d" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0tkdq$i67ssvf@'" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0tkdq$i67ssvfquuuassmquuuassmquuuassmquuuassmquuuassmassmassm3lssruuu" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigiih" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwashington1redmond1microsoft" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3.,t+.1.248.01153941.9.1..6.2sersceietperuqseetcndoee.1.248.01153941.9.1..6.211xehcrpfereneecneocedxe.1.248.01153941.9.1..6.221sessgicnreitifacetneocedxe.1.248.01153941.9.1..6.2sesscerutilybaleneocedxe.1.248.01153941.9.1..6.2semshlsiotyrneocedxe.1.248.01153941.9.1..6.2secsnoettnihtnneocedxenedc1q;j;cm[0" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006516.00000001.299897.10790000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=idwftortug%2fgjytjzq2rasz1ul9dad%2b1q4olijf2jboomacnwadvfdxwaaffoop3h71lnmoefkkwowhxxxha67b5gttzpmmlir0mm9dx08ytn98obn%2bvlfncyp%2bbjtvjwfdyztdkutk16g%3d%3d" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!alt-svch3=" - Source: "00000000-00006516.00000001.299897.13770000.00000004.mdmp") Found URL "https://github.com/lunayuma/moonasbakery-sky" - Source: "00000000-00006516.00000001.299897.D7631000.00000002.mdmp") Found URL "https://github.com/lunayuma/moonasbakery-skyhttps://discord.gg/xpddns3ngahttps://github.com/lunayuma/moonasbakery-sky/releases/latestcandleplantcandlespacemainstreetdawndawn_trialswaterdawn_trialsearthdawn_trialsairdawn_trialsfirenightdesertnight_jarcavenightdesert_beachprairie_islandprairie_nestandkeeperprairie_butterflyfieldsprairie_caveprairie_villagedayhubcavedayendrainrain_basecamprainforestrainshelterrainmidrainendsunsetsunset_citadelsunset_flyracesunsetendsunsetcolosseumsunsetvillagesunset_yetiparksunsetracesunsetend2duskstartduskduskgraveyarddusk_crabfieldduskmidduskendnighttgcofficenightarchivenight_shelternight2mainstreet_cafemainstreet_concerthallrain_cavesunset_theaternight_infinitedesertnight_iphallwayc" - Source: "00000000-00006516.00000001.299897.D7631000.00000002.mdmp") Found URL "https://bakery.moonasbakery.com/rmoonasbakery/2.0.0content-typeapplication/jsonacmgs" - Source: "00000000-00006516.00000002.301818.10790000.00000004.mdmp") Found URL "https://bakery.moonasbakery.com/rbakery.moonasbakery.combakery.moonasbakery.comsecp384r1ecdsacryptoidinfoeccparameterswtls7ecdsacryptoidinfoeccparametersnistp384ecdhcryptoidinfoeccparameterssecp384r1ecdhcryptoidinfoeccparametersnistp192ecdhcryptoidinfoeccparameterswtls7ecdhcryptoidinfoeccparametersnistp521ecdhcryptoidinfoeccparameterssecp224r1ecdsacryptoidinfoeccparametersnistp224ecdsacryptoidinfoeccparametersnistp224ecdhcryptoidinfoeccparameterssecp160r1ecdhcryptoidinfoeccparameterssecp160r2ecdsacryptoidinfoeccparametersnistp256ecdhcryptoidinfoeccparameterssecp160k1ecdsacryptoidinfoeccparameterssecp224k1ecdhcryptoidinfoeccparameterssecp224k1ecdsacryptoidinfoeccparameterssecp521r1ecdsacryptoidinfoeccparameterssecp521r1ecdhcryptoidinfoeccparameterssecp160k1ecdhcryptoidinfoeccparametersnistp384ecdsacryptoidinfoeccparameterssecp160r1ecdsacryptoidinfoeccparameterssecp224r1ecdhcryptoidinfoeccparameterssecp192k1ecdsacryptoidinfoeccparameterssecp192k1ecdhcryptoidinfoeccparameterssecp256k1ecdsacryptoidinfoeccparameterssecp256k1ecdhcryptoidinfoeccparametersnistp521ecdsacryptoidinfoeccparameterssecp160r2ecdhcryptoidinfoeccparameterspc-394ba1244043eey" - Source: "00000000-00006516.00000002.301818.1080C000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=idwftortug%2fgjytjzq2rasz1ul9dad%2b1q4olijf2jboomacnwadvfdxwaaffoop3h71lnmoefkkwowhxxxha67b5gttzpmmlir0mm9dx08ytn98obn%2bvlfncyp%2bbjtvjwfdyztdkutk16g%3d%3d" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0tkdq$i67ssvfedu!$kqu" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0tkdq$i67ssvf@'" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigiih" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwashington1redmond1microsoft" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3.,t+.1.248.01153941.9.1..6.2sersceietperuqseetcndoee.1.248.01153941.9.1..6.211xehcrpfereneecneocedxe.1.248.01153941.9.1..6.221sessgicnreitifacetneocedxe.1.248.01153941.9.1..6.2sesscerutilybaleneocedxe.1.248.01153941.9.1..6.2semshlsiotyrneocedxe.1.248.01153941.9.1..6.2secsnoettnihtnneocedxenedc1q;j;cm[0" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006516.00000002.301818.10842000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=idwftortug%2fgjytjzq2rasz1ul9dad%2b1q4olijf2jboomacnwadvfdxwaaffoop3h71lnmoefkkwowhxxxha67b5gttzpmmlir0mm9dx08ytn98obn%2bvlfncyp%2bbjtvjwfdyztdkutk16g%3d%3d" - Source: "00000000-00006516.00000002.301818.13770000.00000004.mdmp") Found URL "https://bakery.moonasbakery.com/rmoonasbakery/2.0.0content-typeapplication/jsonacmgs" - Source: "00000000-00006516.00000003.309253.10790000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=idwftortug%2fgjytjzq2rasz1ul9dad%2b1q4olijf2jboomacnwadvfdxwaaffoop3h71lnmoefkkwowhxxxha67b5gttzpmmlir0mm9dx08ytn98obn%2bvlfncyp%2bbjtvjwfdyztdkutk16g%3d%3d" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0tkdq$i67ssvf@'" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigiih" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwashington1redmond1microsoft" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3.1.248.01153941.9.1..6.2sersceietperuqseetcndoee.1.248.01153941.9.1..6.211xehcrpfereneecneocedxe.1.248.01153941.9.1..6.221sessgicnreitifacetneocedxe.1.248.01153941.9.1..6.2sesscerutilybaleneocedxe.1.248.01153941.9.1..6.2semshlsiotyrneocedxe.1.248.01153941.9.1..6.2secsnoettnihtnneocedxenedc1q;j;cm[0" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkoducts/miccertrulispca_2009-04-02.crlhhttp://crl.microspki/crl/products/miccertrulispca_2009-04-02.crl0]ahttp://www.microsoft.com/pki/certs/miccertr2009-04-02.crt0+" - Source: "00000000-00006516.00000003.309253.13770000.00000004.mdmp") Found URL "https://github.com/lunayuma/moonasbakery-skyocal\moonasbakeryloadermoonasbakeryloaderinstallid%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02xhi!" - Source: "00000000-00006516.00000003.309253.D761B000.00000002.mdmp")33:T44f,Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.1080C000.00000004.mdmp, 00000000-00006516.00000002.301818.10842000.00000004.mdmp, 00000000-00006516.00000003.309253.1080C000.00000004.mdmp, 00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found string "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.1080C000.00000004.mdmp, 00000000-00006516.00000003.309253.10831000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.10842000.00000004.mdmp, 00000000-00006516.00000003.309253.10831000.00000004.mdmp")34:T545,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000000.297976.10A20000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.10A20000.00000004.mdmp, 00000000-00006516.00000003.309253.10790000.00000004.mdmp, 00000000-00006516.00000003.309253.10A20000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000000.297976.10A20000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.10A20000.00000004.mdmp, 00000000-00006516.00000003.309253.10790000.00000004.mdmp, 00000000-00006516.00000003.309253.10A20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\MoonasBakery-v2.0.0.exe" (Indicator: "\Device\"; Source: "00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.10790000.00000004.mdmp, 00000000-00006516.00000003.309253.10790000.00000004.mdmp")35:Ta31,"MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "MoonasBakery-v2.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "")36:T1b5f,"MoonasBakery-v2.0.0.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MOONA'S BAKERY"; Key: "INSTALLID"; Value: "7260410c-94a4-4612-be00-7d07a4592f49") "MoonasBakery-v2.0.0.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "74040000000000000400040001000400010100000212F80072ED8101A5ADCF00C777D7002B020200000000695303007F450101BF1E0101CF2A010212F80002388F020238F2020292300302E6380103123103032D3A0303AA2B010474580304931A01057A050306596C0107AB1703086A6703088D420108C557030921B500095AA9020992F8000996600309A3360109CA760309EF7D000A7A05030B9292010B9F75030CBB5A030CE9C2000D3045030D37C6000D7879000DA181000DAF63030DBE82010DC461030DD3F9000DDB80010E013E010E963D010EBACD000F05DE001142C200118AE60211DCE4021202050312E5F8001312310313BC940113BED00213E978001564630315B6250115CEEB00173F5E011793380117D9D40217FADD02189AC7021920610319C0E2001A0A2B031A912C031B4278001BF60B001C955C001CA721011CB949031D4912011E1B35031E25A8021F4EA8001FC738031FD80E032018F20020DA160320DB370321013E0121777A002311AF02231F520323A8200323CC4F012429FE02246B460124ACC700253AD50025BE1701262CC202268B0A03269F2D032704AE022717B60227406A032769120127DB21012812EA0228A11B012919410129203B0129B160032A024A032A0E39012A68A9002AB722012AC7DE002AE768032B2499002B9F5B022BE9CA022C3D81002CC9EE022CD842012D2152032D5838012DD8F4002E29F3022F39D5002F4759032F9546012FB6F6023050250130E98E03311160033115E70231484F003193040331CF4402322916033257A4003263C30233DF5D01352C5D0235B3300335CC470336B85E0136F81D01373938033789BF02380E670139DF94023A0A9E023A5460033BCE34013BF4DD023C2E3A023CB352003D73EB023E3383003EA5FA003ED9CC013F239F023F7B6F034056F10040B02A014188A60241A87600421D0B0142264A00427A5D0342B3AE00447AE602458D6D03461D0B01463F17034648B6004679D10046C221014732EE0247B1490347E44C03485B750348C24F0048D7700348F9A60049EAB7004AAA81004BF4C2014C37FA004C41B4004CA770004CC84B014DCB6C034E1224014E8D22034E9FF0004EE7C1004F14C2004F34280150406A0350614E0350EA43015232300252A7AA00547A520054B7DC00552D2003555F2A01560A850057AD120157BB4402580BD00058AB1703590F1C01595394005A5EB5005BE834035C7465015C926B035CF431025F997A0360622E0360BA32026113240161CA2A0162226803625AC6016396770063BE7A0364D419016530540165C9760365D36800664D6003671C8A02673B5B0167F16A036830F00268CF72036978EB02698DB9026AC562026B1060036B1DA8026BED71036C2885026D3E43016E5E63036E7820036EF841016F00BC026F9777036FB3110170DB6D0370FD2903710528017140A3007179730371965803723C1200726E4A00729B370172A2420172ED81017355FD0273866E037477AD0074C7A40275A37E0075AB0A017679E90276BC210177A66D0377EE6E037808EC027815960079856103799C390079D46D037A8B88037AE393017B45D5007B62CE027B863D027B9FEB007BA8D1007BEE63037D45BE027E1044017F88CA007FC1A802804A710281069500822773008258680183061B0183F16000844D26018450EB0084E6830085124A008550AE00867B0601876A49018792170187B14D0187D7210187DE830087F025018893A002892F83028997F5008A8093008AD300028AFAE3008B4E1D018B5188008B9DA1018BEEF2008C1360038CE6F5028E1D68038E78A2008ED6DC018F88A20290194F0390A6A10190EE37019123D3009158A40291C47B039386610093CE8C0194BB5A03950BFE00959F330195CAD00295E1DB00965DD200971C6103976AB60097748D0097F6C40098724601987F5C03992D720399FEF7019A18D7029B2BDB009B4D87009C1F4D039C4741019C623A019C7E6A039CA4EB009CC37E039CE0A8009D9D92009E98BB029F47B5029F9192019FEBD402A08F4E03A0E70F03A10E3603A189C700A1D07B02A2050600A221C802A2589C02A2BB1A03A3568803A37ABA02A39B8703A3B24E03A3D40803A3E71501A4580200A4BA3701A5ADCF00A61CA802A644A600A6E9B300A736A800A754A102A7B8AD00A841F102A8680903A8C81503A9170602A95E1E03AC54F900AC9A6C03AD73BF00ADD4EC00AEC78F02B054A102B0A05403B0F62E03B1B39F02B291DD00B2AA2101B3008103B392FB00B3BF2D01B4526303B47E5803B4F76703B4F9EA00B554A102B5610D01B5F67303B7F00202B8343801B854A102B8673B01B8947603B91AF300B99EC901BAEA5A03BAF9E900BB6A8502BB8E8B00BC54A102BC6EB400BCD22A01BCFA8D00BD388F00BD447403BD539800BE0CAC00BE7E4501BE827203BF516003BF8ECE00BFAB1703C046AD00C054A102C0DB4901C1B2AA02C20C5B02C2610B01C33EA300C36D8100C399F300C3AEF102C4274E03C535C900C561EA01C6BE4201C75DD700C777D700C8464E00C9262D01C92FB902C9384F01C9389700C953F100CA23B700CA99CE00CB74DA00CBB9E902CC495600CDAA1703CDAD0501CF676901CF74AA00CFF42B02D0175600D19A7B00D1D2A700D2A92B01D3826100D3C7AF00D3E88D00D45AC702D4D17A03D6ECC602D6F6DE00D73DEB02D9072401D9286803D9A28003D9F95503DA163E02DA38C801DAC97603DAFF0E00DB19EC02DB26D801DB677F03DB724701DBB2CC02DD1B1901DF1F8001DF416303DFA8C601DFDA3703E03EE701E061C302E0943802E0F56603E1790503E17E8C00E183AC02E1D9F502E21B5600E2907C03E2A25403E3E25B03E4402701E469C900E5CE9A02E5D95903E63E2B0DE66C8100E6FB3903E71BEC02E8803F02E89EFA00E8E09501E91BB302E98C0A01EA94CC02EAC66A03ED3EDC02EDCE8403EE051703EF264D03EF798B00F01C3F03F0E0B600F15CD402F17D5F00F1FC6000F2B4FA00F308DB00F3282101F36E7603F4CC3E01F548B100F5500D01F5572A01F6DD3C03F7125E00F7D36F00F7DAAD01F7E89101F7ED6A00F7EE4501F9778C00F9BB9401F9EA9E02FA408503FB080601FB365B03FC3A4701FD676403FDDFE501FF340002FF5C5E01FFAB4503F000060000000047F10000EB9E0201914001021C410102354F0102A4150102BD7E0004921E010537C600059D3D0305A43C01068653030A29D8000BFF5C000C771A010D9A03010E4D7E000E9D19010FBA9E00110FAA00117C450112B95D0313198300132FD30014AAFD0015402801159ADB0015BCB701181F1B0119C398001A59F7021AFA99001B07F5021E513D03227A4C0322D38900246F160024798902279BCE0027A2A200288BB4002900D800295563032C21D7002DB1A3002E534C012F28F00232551E013256AE0032D45F013307F50234BBEF0036D841013706F4023722C70037F81D013AE8CC023D5E35013F1CEA0042315F00427F7A004293800042C46A0048C6F5004BC836014BDE41014CAF71004D863E034F0B45014F6B6803508FC40052221301528C490153D88F0054202B0154C6FB025677E80256B722015787490159E5D30059EA60015C24C7025CC005015D4F44015DB340015E42C4005F6C4A015F6CDC0060AA560160B9410161FC390162295101628E7403633E99006363810064C92601657A4C036768A7006843CE026B0110016E7B8C00702C480370BF190170E8250172D8360173D3A70076418E0077BB2B01792D4F017A2226017C22B8007C78A4008009EF02821ABA0082E6F40084680B018571190387279C028B52CB008BA36B038C3BD3008CAB17038D0547018E08C4028F0643018F3CF30091508A009167C80091962201922F9302928271009283510192C41401930547019369C70096390B01994664019AC657019B56A4009C4027019CA553039D9FA0009F60C3009F8F6E009FC8CA00A0B50A01A19D2A01A1D7B300A3B06D03A3C4E200A3F76A00A428F302A5022703A5040301A522A400A58F6000A638DA00A7C23301A9B2DB00AA9FCE02AAA82503AB783D01AC840E01ADEFD302AF686403AFEFC900B0755E00B1414503B4892201B57A4801B6515D00B6D7E602B7E2BF00B9E36D03BA146500BA6CD402BC5F1A01BEDF4403BFC82603BFF1A900C221D100C2278403C3812101C3DC2403C6064E03C82BFC00C9D7CA00CAC5FB02CCC10101CCE11703D0402701D0D32201D0FE6200D12A5201D1589600D3301C01D3834B01D3FE2103D68EFB00D6B79A00D8793D01D9054C03D9114401DA19D700DAD87E00DC30D100DC63F402DDEB2601DE016D03DFD52201DFD83601E3192F01E42C4C01E6199B00E6B92B01E7163001E79B3B01E8A4C601E9D1F500EAB94F00ED3FDC02F00E4E01F03ADD00F19F4301F21B3203F3791E03F3894001F4062801F4793D01F4AD7A00F4C82F01F629F302F65FE401F6D9EC00F7D45F01F8719A00FA67CB00FCA53B03FE5BFE00FF506003010007000000E42C4C010900400100000212F8002DD8F4004B11B4006041AE007BA8D1008AFAE3009F27FF00A5ADCF00C777D70005004101000006596C012AB72201C9384F01CDAD0501CFF42B0203004201000027691201380E670172ED8101010043010000C0EC7C0001004601000090A6A10100")37:Ta0f,Found string "AdjustWindowRectExForDpi" (Source: MoonasBakery-v2.0.0.exe, API is part of module: USER32.DLL) Found string "LoadLibraryW" (Source: MoonasBakery-v2.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "GetDpiForWindow" (Source: MoonasBakery-v2.0.0.exe, API is part of module: USER32.DLL) Found string "sqrtf" (Source: MoonasBakery-v2.0.0.exe, API is part of module: UCRTBASE.DLL) Found string "ShellExecuteA" (Source: MoonasBakery-v2.0.0.exe, API is part of module: SHELL32.DLL) Found string "BCryptCloseAlgorithmProvider" (Source: MoonasBakery-v2.0.0.exe, API is part of module: BCRYPT.DLL) Found string "BCryptCreateHash" (Source: MoonasBakery-v2.0.0.exe, API is part of module: BCRYPT.DLL) Found string "BCryptDestroyHash" (Source: MoonasBakery-v2.0.0.exe, API is part of module: BCRYPT.DLL) Found string "BCryptFinishHash" (Source: MoonasBakery-v2.0.0.exe, API is part of module: BCRYPT.DLL) Found string "BCryptGetProperty" (Source: MoonasBakery-v2.0.0.exe, API is part of module: BCRYPT.DLL) Found string "BCryptHashData" (Source: MoonasBakery-v2.0.0.exe, API is part of module: BCRYPT.DLL) Found string "BCryptOpenAlgorithmProvider" (Source: MoonasBakery-v2.0.0.exe, API is part of module: BCRYPT.DLL) Found string "CreateFontA" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "ExtTextOutW" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "GetStockObject" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "GetTextExtentPoint32A" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "GetTextMetricsA" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "GetTextMetricsW" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "IntersectClipRect" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "RestoreDC" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "SaveDC" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "SetBrushOrgEx" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "SetStretchBltMode" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "SetTextAlign" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL) Found string "SetViewportOrgEx" (Source: MoonasBakery-v2.0.0.exe, API is part of module: GDI32FULL.DLL)38:Tc42,"MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "MoonasBakery-v2.0.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")39:Tb98,Found reference to API "AddAce" (Indicator: "AddAce"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "MoonasBakery-v2.0.0.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003500.00000000.95047.FFF11000.00000020.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00003500.00000000.95047.FFF11000.00000020.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00003500.00000000.95047.FFF11000.00000020.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003500.00000000.95047.FFF11000.00000020.mdmp") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003500.00000000.95047.FFF11000.00000020.mdmp")3a:Td41,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6AEAE8F2.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6AEAE8F2.bin]3b:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W+0/VZRzH+Qf6B1q/ZrXWZvlDZytkoRubgkqA42hF3lBDSg3i5uEL89JIWhg0cjitSQgH0SlT87ICQuDAcbYuc0GNgK3LzMvkJma9fV6Pfb/R8fwATful8xnP2YfP5315nuf7PN994+JiEYtY/MuQ+QtmZNjhOPz7HwXG0Qyp0Yus35dA+HMnQZLjGdSt8ak2Y672+5/WR6/4vDoYi31Qk6lY+JgOrvUpuOF5tZUnq7siVY2vxdvajsRH76+pu9WO7xG15MTrrLNIx95KVGj3ixptK9DYF0WaCAU02l6gHlOjBwYsnOkasw6Zw+XmZwOL9GdnkXSxXD8GN+hS/Wrd6ivTaEeRMS+0OTV6YMDCiaY1o+Bku3nHzhTd7i7RRFexpsKOet/364dD2brVW2p3gEFOjR4YsHDgRtOMGhwac3KkvdkWeGRLosKVGbpycrMme0p0w6x0KlSqcLVfv5raze5tGu8stoOcGj0wYOHARQMt62G0rUfkAY18TnUrntFwc47+MM935FiuJru22ZVOGqPOd9J09VyeWWWJNwFyavTAWKzhwEUDLTSne3ie7mxefvghnS5cqBN5ieqrzpS+2q5fTr6hn1tftyucOF+i65/lq6sy3eauuTcJU6MHhhwOXDTQQhNtPPDyvPk5kDVP7aVJutqYpf6aNA235NitvHx6q0aObrJik2aVlz/dop73lmuqJ3DPBKjRAwMWDlw00EITbTzwwtN7FMfffEHjLav0U/1KfVudqqHDTCCgG+aqDdSvvWtgRAbNKb9Q49ftPkdj5ga45uTU6IEBSx0uGmihiTYeeOHpPo64Q+alMnJghUY+fknf1aZrqHmjJU0Yke8/Weed9H4jONCwTr/3ld4zAWr0wLg3BC4adgJGE2088MLTm0DF4if0ZeUyXQm+qsF9mQq9m6axv7b1m31Z9orp0tsKVWXqXFmyufeOdwW9q2hq9MCAhQMXDbTQRBsPvPC05pxGRkP2cwrtSta1pixdrFqigSZj+vUOe7rPBJIU3uO329mab65nzUqz4nKNny+2g5waPTBg4cBFAy000cYDL9fXToK7aSez4HGdyl+g/g/S1bt7mcK1fv3WmqubHYW6ULXcGgw3rtfhTfPVVrZYHdtT7CCnRg8MWDhw0UALTbTxmO7pRTD495uqftWzOmPAx3Pjtdc/Vy2583WqOElVKXN0cLVPTRvjVb30SX2Y9pQd5NTogQELBy4aaKEZzesfwZa4zcrkeWo25EjMbAMNtMjRjnzpRY3p720nIcF+9RD2o8Nx7P11v4bcQY2exZiwX0qGG01zRsEzmjUpStyd/AxWHYtY/G/jDhGSOOIsaR/mAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":76,"unified_at_epoch_ms":1793756637554,"unified_at":"2026-11-04T01:43:57.554Z","metadata":{"hashes":{"sha256":"3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","sha1":"e3a3e37d98dec06f4e15af8c898847941c7b191d","md5":"a0d0ccba21adbd5da83638ce8727af97","sha512":"a59438ce84450b5bded9fe727e5a48fad30d8f04dc973c6696dbd423e57c9aa8a3558cb4723b90afa27743acd8771508ab3dd8c7f9c581bff9d2845b5b65ddc9","ssdeep":"12288:uXoJ8oG7chKIO17y9DyaSQb6R1BXgXs8vYKS8vVww:N6cs1qQXBXg8KSMV5","ssdeep_chunks":["12288:uXoJ8oG","12288:XoJ8oG7","12288:oJ8oG7c","12288:J8oG7ch","12288:8oG7chK","12288:oG7chKI","12288:G7chKIO","12288:7chKIO1","12288:chKIO17","12288:hKIO17y","12288:KIO17y9","12288:IO17y9D","12288:O17y9Dy","12288:17y9Dya","12288:7y9DyaS","12288:y9DyaSQ","12288:9DyaSQb","12288:DyaSQb6","12288:yaSQb6R","12288:aSQb6R1","12288:SQb6R1B","12288:Qb6R1BX","12288:b6R1BXg","12288:6R1BXgX","12288:R1BXgXs","12288:1BXgXs8","12288:BXgXs8v","12288:XgXs8vY","12288:gXs8vYK","12288:Xs8vYKS","12288:s8vYKS8","12288:8vYKS8v","12288:vYKS8vV","12288:YKS8vVw","12288:KS8vVww","24576:uXoJ8oG","24576:XoJ8oG7","24576:oJ8oG7c","24576:J8oG7ch","24576:8oG7chK","24576:oG7chKI","24576:G7chKIO","24576:7chKIO1","24576:chKIO17","24576:hKIO17y","24576:KIO17y9","24576:IO17y9D","24576:O17y9Dy","24576:17y9Dya","24576:7y9DyaS","24576:y9DyaSQ","24576:9DyaSQb","24576:DyaSQb6","24576:yaSQb6R","24576:aSQb6R1","24576:SQb6R1B","24576:Qb6R1BX","24576:b6R1BXg","24576:6R1BXgX","24576:R1BXgXs","24576:1BXgXs8","24576:BXgXs8v","24576:XgXs8vY","24576:gXs8vYK","24576:Xs8vYKS","24576:s8vYKS8","24576:8vYKS8v","24576:vYKS8vV","24576:YKS8vVw","24576:KS8vVww","12288:N6cs1qQ","12288:6cs1qQX","12288:cs1qQXB","12288:s1qQXBX","12288:1qQXBXg","12288:qQXBXg8","12288:QXBXg8K","12288:XBXg8KS","12288:BXg8KSM","12288:Xg8KSMV","12288:g8KSMV5"],"imphash":"1ec6800caf0063af8373da79de95c1d4"},"file_info":{"file_name":"MoonasBakery-v2.0.0.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":698368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793755831000,"last_seen":1793756143000,"last_multi_scan":1793756143000}},"detections":{"summary":{"verdict":"malicious","score":76,"tags":["windows-server-utility"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":74},"sandbox_signatures":{"informative_count":167,"suspicious_count":18,"malicious_count":1,"total":186},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_60.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware_60.0","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"malicious","value":"PE file contains executable resources"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Contains asymmetric cryptographic functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Defense Impairment","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"tactic":"Stealth","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.009","id":"yara-26","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"BakeryMod did not start.\n\nThis version of Sky is not supported by this build.\n\nNothing was changed in the game.\n\nWatch https://github.com/LunaYuma/MoonasBakery-Sky for new builds.\" (Indicator: \"github.com\"), \"https://github.com/LunaYuma/MoonasBakery-Sky\" (Indicator: \"github.com\"), \"https://github.com/LunaYuma/MoonasBakery-Sky/releases/latest\" (Indicator: \"github.com\"), \"github.com/LunaYuma/MoonasBakery-Sky \" (Indicator: \"github.com\"), \"github.com/LunaYuma/MoonasBakery-Sky\" (Indicator: \"github.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"SHCreateDirectoryExW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Moona's Bakery\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"BakeryMod did not start.\n\nThis version of Sky is not supported by this build.\n\nNothing was changed in the game.\n\nWatch https://github.com/LunaYuma/MoonasBakery-Sky for new builds.\" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \"https://github.com/LunaYuma/MoonasBakery-Sky\" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \"https://github.com/LunaYuma/MoonasBakery-Sky/releases/latest\" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \"github.com/LunaYuma/MoonasBakery-Sky \" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \"github.com/LunaYuma/MoonasBakery-Sky\" (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set strength, then press Bounce.\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set the size, then press Giant Flowers.\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; Source: \"sample.bin\"), Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"sample.bin\"), Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetMonitorInfoA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"sample.bin\"), Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\", Found HTTPS url \"https://discord.gg\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://github.com/lunayuma/moonasbakery-sky\", Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\", Pattern match: \"discord.gg/xpddns3nga\", Pattern match: \"https://discord.gg/xpddns3nga\", Pattern match: \"https://github.com/lunayuma/moonasbakery-sky/releases/latest\", Heuristic match: \"bakery.moonasbakery.com\", Pattern match: \"github.com/lunayuma/moonasbakery-sky\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\"), Found reference to API \"WinHttpSetTimeouts\" (Indicator: \"WinHttpSetTimeouts\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpCloseHandle\" (Indicator: \"WinHttpCloseHandle\"; Source: \"sample.bin\"), Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"sample.bin\"), Found reference to API \"WinHttpQueryHeaders\" (Indicator: \"WinHttpQueryHeaders\"; Source: \"sample.bin\"), Found reference to API \"WinHttpReceiveResponse\" (Indicator: \"WinHttpReceiveResponse\"; Source: \"sample.bin\"), Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-323","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpSendRequest\" (Indicator: \"HttpSendRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"sample.bin\"), Found reference to API \"WinHttpQueryHeaders\" (Indicator: \"WinHttpQueryHeaders\"; Source: \"sample.bin\"), Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-537","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$28","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"sample.bin\"), Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-927","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"BCryptGetProperty\" (Indicator: \"BCryptGetProperty\"; Source: \"sample.bin\"), Found reference to API \"BCryptCreateHash\" (Indicator: \"CryptCreateHash\"; Source: \"sample.bin\"), Found reference to API \"BCryptHashData\" (Indicator: \"CryptHashData\"; Source: \"sample.bin\"), Found reference to API \"BCryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains asymmetric cryptographic functions (API string)","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573.002","id":"string-398","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\"), Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"sample.bin\"), Found reference to API \"Module32FirstW\" (Indicator: \"Module32First\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"Module32NextW\" (Indicator: \"Module32Next\"; Source: \"sample.bin\"), Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"sample.bin\"), Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegGetValueW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW failed (%lu)\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Skipped %s: no exit route from %s.\" (Indicator: \"route\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should your Moona's Bakery folder go?\" (Indicator: \"where \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-484","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\"), Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"sample.bin\"), Found reference to API \"VirtualFreeEx\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"sample.bin\"), Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-79","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.1080C000.00000004.mdmp, 00000000-00006516.00000002.301818.10842000.00000004.mdmp, 00000000-00006516.00000003.309253.1080C000.00000004.mdmp, 00000000-00006516.00000003.309253.10831000.00000004.mdmp\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000000.297976.13770000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.13770000.00000004.mdmp, 00000000-00006516.00000002.301818.10842000.00000004.mdmp, 00000000-00006516.00000002.301818.13770000.00000004.mdmp, 00000000-00006516.00000003.309253.10831000.00000004.mdmp, 00000000-00006516.00000003.309253.13770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006516.00000001.299897.D7631000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"MoonasBakery-v2.0.0.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"MoonasBakery-v2.0.0.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"MoonasBakery-v2.0.0.exe\" queried SystemProcessInformation at 00000000-00006516-00000C15-3559224767 [PID: 6516]\n \"MoonasBakery-v2.0.0.exe\" queried SystemProcessInformation at 00000000-00006516-00000C15-3559230758 [PID: 6516]\n \"MoonasBakery-v2.0.0.exe\" queried SystemProcessInformation at 00000000-00006516-00000C15-3559373301 [PID: 6516]\n \"MoonasBakery-v2.0.0.exe\" queried SystemProcessInformation at 00000000-00006516-00000C15-3559379647 [PID: 6516]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor r8d\n 01h in Stream UID: 717-3382-0000000140004EA9\n Assembly shows XOR instruction xor eax\n 01h in Stream UID: 717-3382-0000000140004EA9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.10790000.00000004.mdmp, 00000000-00006516.00000003.309253.10790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.10842000.00000004.mdmp, 00000000-00006516.00000003.309253.10831000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 76547; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 672216; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 53573; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 600601; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 640168; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 641976; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 668888; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"MoonasBakery-v2.0.0.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00006516)\n \"MoonasBakery-v2.0.0.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006516)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"MoonasBakery-v2.0.0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006516)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"MoonasBakery-v2.0.0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006516)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.dll at 717-3414-000000014000664A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"MoonasBakery-v2.0.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver from the old one, and left the old folder alone.\" (Indicator: \"ver \") in Source: MoonasBakery-v2.0.0.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcess@KERNEL32.dll at 717-3341-000000014000336A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"MoonasBakery-v2.0.0.exe\" queried token user identity (UID: 00000000-00006516)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"MoonasBakery-v2.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"MoonasBakery-v2.0.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\"MoonasBakery-v2.0.0.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006516)\n \"MoonasBakery-v2.0.0.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006516)\n \"MoonasBakery-v2.0.0.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006516)\n \"MoonasBakery-v2.0.0.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006516)\n \"MoonasBakery-v2.0.0.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00006516)\n \"MoonasBakery-v2.0.0.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006516)\n \"MoonasBakery-v2.0.0.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006516)\n \"MoonasBakery-v2.0.0.exe\" called \"GetProcAddress\" with a parameter GetDpiForWindow (UID: 00000000-00006516)\n \"MoonasBakery-v2.0.0.exe\" called \"GetProcAddress\" with a parameter AdjustWindowRectExForDpi (UID: 00000000-00006516)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"bakery.moonasbakery.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.73.230:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 717-3341-000000014000336A\n WaitForSingleObject@KERNEL32.dll at 717-5709-000000014000499C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: MoonasBakery-v2.0.0.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process MoonasBakery-v2.0.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6516:304:WilStaging_02\"\n Process MoonasBakery-v2.0.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\MoonasBakeryLoader\"\n Process MoonasBakery-v2.0.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6516:304:WilStaging_02\"\n Process MoonasBakery-v2.0.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6516:120:WilError_03\"\n Process MoonasBakery-v2.0.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6516:120:WilError_03\"\n Process MoonasBakery-v2.0.0.exe created mutex with name \"Local\\SM0:6516:304:WilStaging_02\"\n Process MoonasBakery-v2.0.0.exe created mutex with name \"SM0:6516:304:WilStaging_02\"\n Process MoonasBakery-v2.0.0.exe created mutex with name \"MoonasBakeryLoader\"\n Process MoonasBakery-v2.0.0.exe created mutex with name \"SM0:6516:120:WilError_03\"\n Process MoonasBakery-v2.0.0.exe created mutex with name \"Local\\SM0:6516:120:WilError_03\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"MoonasBakery-v2.0.0.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: MoonasBakery/2.0.0\" (Indicator: \"user-agent: \"; Source: \"00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.1080C000.00000004.mdmp, 00000000-00006516.00000003.309253.10831000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00006516.00000003.309253.10790000.00000004.mdmp\n \"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006516.00000003.309253.10831000.00000004.mdmp\n \"Software\\Moona's Bakery\" in Source: 00000000-00006516.00000003.309253.D761B000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"MoonasBakery-v2.0.0.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 51B10000\n \"MoonasBakery-v2.0.0.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 51D40000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"MoonasBakery-v2.0.0.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 53100000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a3fb51fd7f0000@ntdll.dll\"\n \"220023000000000038a3fb51fd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"MoonasBakery-v2.0.0.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"MoonasBakery-v2.0.0.exe\" has an writable section named \".data\"\n \"MoonasBakery-v2.0.0.exe\" has an writable section named \".bss\"\n \"MoonasBakery-v2.0.0.exe\" has an writable section named \".idata\"\n \"MoonasBakery-v2.0.0.exe\" has an writable section named \".CRT\"\n \"MoonasBakery-v2.0.0.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"MoonasBakery-v2.0.0.exe\" file has an entrypoint instructions - \"push\trbp,mov\trbp, rsp,sub\trsp, 0x20,mov\trax, qword ptr [rip + 0xd021],mov\tdword ptr [rax], 1,call\t0x140001190,nop\t,nop\t,add\trsp, 0x20,pop\trbp,ret\t,nop\tword ptr cs:[rax + rax],nop\tdword ptr [rax],push\trbp,mov\trbp, rsp,sub\trsp, 0x20,mov\trax, qword ptr [rip + 0xcff1],mov\tdword ptr [rax], 0,call\t0x140001190,nop\t,nop\t,add\trsp, 0x20,pop\trbp,ret\t,nop\tword ptr cs:[rax + rax],nop\tdword ptr [rax],push\trbp,mov\trbp, rsp,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"MoonasBakery-v2.0.0.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bakery.moonasbakery.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"MoonasBakery-v2.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"MoonasBakery-v2.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: F7:16:D8:26:9D:8B:53:78:2C:85:24:73:F1:6D:54:5A:98:71:CB:1E; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"MoonasBakery-v2.0.0.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"MoonasBakery-v2.0.0.exe\" queries basic process information of the \"C:\\MoonasBakery-v2.0.0.exe\" (UID: 6516)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"MoonasBakery-v2.0.0.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006516)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"MoonasBakery-v2.0.0.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"MoonasBakery-v2.0.0.exe\" trying to touch file \"C:\\dwmapi.dll\"\n \"MoonasBakery-v2.0.0.exe\" trying to touch file \"C:\\Windows\\System32\\dwmapi.dll\"\n \"MoonasBakery-v2.0.0.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\dwmapi.dll\"\n \"MoonasBakery-v2.0.0.exe\" trying to touch file \"C:\\WINHTTP.dll\"\n \"MoonasBakery-v2.0.0.exe\" trying to touch file \"C:\\Windows\\System32\\winhttp.dll\"\n \"MoonasBakery-v2.0.0.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\WINHTTP.dll\"\n \"MoonasBakery-v2.0.0.exe\" trying to touch file \"\\Device\\KsecDD\"\n \"MoonasBakery-v2.0.0.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"MoonasBakery-v2.0.0.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"MoonasBakery-v2.0.0.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"MoonasBakery-v2.0.0.exe\" trying to touch file \"C:\\WINDOWS\\system32\\oleaut32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"MoonasBakery-v2.0.0.exe\" trying to access non-existent file \"C:\\Windows\\SystemResources\\USER32.dll.mun\"\n \"MoonasBakery-v2.0.0.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"MoonasBakery-v2.0.0.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"1d7107c8e70\"\n \"lpszHeaders\": \"Content-Type: application/json\"\n \"dwHeadersLength\": \"4294967295\"\n \"lpOptional\": \"{\\\"id\\\":\\\"7260410c-94a4-4612-be00-7d07a4592f49\\\",\\\"v\\\":\\\"2.0.0\\\"}\"\n \"dwOptionalLength\": \"57\"\n \"dwTotalLength\": \"57\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"MoonasBakery-v2.0.0.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1d7107c8e70\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /r\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$32","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST /r HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000002.301818.1080C000.00000004.mdmp, 00000000-00006516.00000003.309253.10831000.00000004.mdmp\")\n Found string \"HTTP/1.1 204 No Content\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000000.297976.13770000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.13770000.00000004.mdmp, 00000000-00006516.00000002.301818.13770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"bakery.moonasbakery.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://bakery.moonasbakery.com/r","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"bakery.moonasbakery.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.73.230\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00006516\"\n YARA signature for encryption algorithm file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006516.00000000.297976.10790000.00000004.mdmp, 00000000-00006516.00000001.299897.10790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"MoonasBakery-v2.0.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: MoonasBakery-v2.0.0.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$34","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"MoonasBakery-v2.0.0.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"MoonasBakery-v2.0.0.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00006516.00000000.297976.13770000.00000004.mdmp, 00000000-00006516.00000001.299897.13770000.00000004.mdmp, 00000000-00006516.00000002.301818.13770000.00000004.mdmp, 00000000-00006516.00000003.309253.13770000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"dow (RuntimeBroker.exe)\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 717-3292-0000000140001480\n GetModuleHandleW@KERNEL32.dll at 717-3341-000000014000336A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\MoonasBakery-v2.0.0.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/24 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 717-3415-0000000140003800","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"\"POST /r HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/json\nUser-Agent: MoonasBakery/2.0.0\nContent-Length: 57\nHost: bakery.moonasbakery.com\" with payload::==> \"{\"id\":\"7260410c-94a4-4612-be00-7d07a4592f49\",\"v\":\"2.0.0\"}\" HTTP/1.1 204 No Content\nDate: Wed\n 04 Nov 2026 01:30:56 GMT\nConnection: keep-alive\nServer: cloudflare\ncf-cache-status: DYNAMIC\nServer-Timing: cfCacheStatus;desc=\"DYNAMIC\"\nServer-Timing: cfEdge;dur=50\ncfOrigin;dur=566\nReport-To: {\"group\":\"cf-nel\"\n\"max_age\":604800\n\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iDwfToRtuG%2FGjytjzQ2rASz1UL9DaD%2B1Q4oLIJF2jbOOmAcNWadvfdXWAAffoop3H71lnMoeFKkwoWHxxXha67b5gTtzPmMlIR0mM9dx08yTN98oBn%2BvlfncYp%2BBJtvjwfDyZtDKUtk16g%3D%3D\"}]}\nNel: {\"report_to\":\"cf-nel\"\n\"success_fraction\":0.0\n\"max_age\":604800}\nCF-RAY: a54fdb357f80cf22-SJC\nalt-svc: h3=\":443\"; ma=86400 with no response body","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.73.230 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.dll at 717-3292-0000000140001480","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"MoonasBakery-v2.0.0.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"3010bb9\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"MoonasBakery-v2.0.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"MoonasBakery-v2.0.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"MoonasBakery-v2.0.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"MoonasBakery-v2.0.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"MoonasBakery-v2.0.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 717-3322-0000000140001AB4\n Module32NextW@KERNEL32.dll at 717-3323-00000001400080E8\n Module32FirstW@KERNEL32.dll at 717-3324-00000001400080F0\n CreateToolhelp32Snapshot@KERNEL32.dll at 717-3325-0000000140008188\n CreateToolhelp32Snapshot@KERNEL32.dll at 717-3341-000000014000336A\n Process32NextW@KERNEL32.dll at 717-3342-00000001400080C0\n Process32FirstW@KERNEL32.dll at 717-3345-00000001400080C8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$38","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n WriteProcessMemory\n CreateFileW\n FindResourceW\n OpenProcess\n WriteFile\n VirtualAllocEx\n CreateRemoteThread\n FindFirstFileW\n VirtualProtect\n Process32FirstW\n GetStartupInfoW\n GetFileSizeEx\n CopyFileW\n DeleteFileW\n CreateToolhelp32Snapshot\n FindNextFileW\n CreateThread\n GetModuleHandleW\n GetFileAttributesW\n GetProcAddress\n Process32NextW\n LockResource\n Sleep\n ShellExecuteW\n FindWindowW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"MoonasBakery-v2.0.0.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"MoonasBakery-v2.0.0.exe has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 5.02 (DLL)\n x86-64 (stripped to external PDB)\n 10 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"DISMHOST.EXE.6AEAE8F2.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"MoonasBakery-v2.0.0.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000948-00000C2C-82134239\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"MoonasBakery-v2.0.0.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00000948)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"MoonasBakery-v2.0.0.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000948)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"MoonasBakery-v2.0.0.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"MoonasBakery-v2.0.0.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"MoonasBakery-v2.0.0.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"MoonasBakery-v2.0.0.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"MoonasBakery-v2.0.0.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6AEAE8F2.bin\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"MoonasBakery-v2.0.0.exe\" called \"LoadLibrary\" with a parameter dwmapi.dll (UID: 00000000-00000948)\n \"MoonasBakery-v2.0.0.exe\" called \"LoadLibrary\" with a parameter WS2_32.dll (UID: 00000000-00000948)\n \"MoonasBakery-v2.0.0.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00000948)\n \"MoonasBakery-v2.0.0.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00000948)\n \"MoonasBakery-v2.0.0.exe\" called \"LoadLibrary\" with a parameter SspiCli.dll (UID: 00000000-00000948)\n \"MoonasBakery-v2.0.0.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\ole32.dll (UID: 00000000-00000948)\n \"MoonasBakery-v2.0.0.exe\" called \"LoadLibrary\" with a parameter RPCRT4.dll (UID: 00000000-00000948)\n \"MoonasBakery-v2.0.0.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\MSCTF.dll (UID: 00000000-00000948)\n \"MoonasBakery-v2.0.0.exe\" called \"LoadLibrary\" with a parameter DNSAPI.dll (UID: 00000000-00000948)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"MoonasBakery-v2.0.0.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"MoonasBakery-v2.0.0.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.6AEAE8F2.bin\" as clean (type is \"PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DISMHOST.EXE.6AEAE8F2.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00000948-00000C2B-81706990]\n Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00000948-00000C2B-81879027]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"MoonasBakery-v2.0.0.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"dism.log\" has type \"Unicode text UTF-8 (with BOM) text with very long lines (316) with CRLF line terminators\"- [targetUID: 00000000-00000948]\n \"DISMHOST.EXE.6AEAE8F2.bin\" has type \"PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections\"- [targetUID: 00000000-00000948]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00000948.00000000.89772.00C30000.00000002.mdmp, 00000000-00000948.00000001.91695.00C30000.00000002.mdmp, 00000000-00000948.00000002.93615.00C30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE45747E6DA925425CB297D1A4E4B8]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003500.00000000.95047.001B0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEFFFD31D9715543B69BCB913DDB9C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003500.00000000.95047.001B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"MoonasBakery-v2.0.0.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"MoonasBakery-v2.0.0.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003500.00000000.95047.FFF11000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"MoonasBakery-v2.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.6AEAE8F2.bin\" has type \"PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections\"- [targetUID: 00000000-00000948]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DISMHOST.EXE.6AEAE8F2.bin\" claimed CRC 700178 while the actual is CRC 141269","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]}],"intel_graph":{"map":{"Domain:bakery.moonasbakery.com":{"type":"Domain","value":"bakery.moonasbakery.com"},"Domain:www.google.com":{"type":"Domain","value":"www.google.com"},"File:3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f":{"type":"File","value":"3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f"},"File:9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6":{"type":"File","value":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6"},"File:f19cd6c4f11a3332c0af7d10691a5fc0ad2c76dfce2a1aee33137a97a7b98f4d":{"type":"File","value":"f19cd6c4f11a3332c0af7d10691a5fc0ad2c76dfce2a1aee33137a97a7b98f4d"},"Ip:104.21.73.230":{"type":"Ip","value":"104.21.73.230"},"Ip:172.67.192.176":{"type":"Ip","value":"172.67.192.176"},"Url:/r":{"type":"Url","value":"/r"}},"chains":[{"id":"sandbox_network","root":"File:3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","edges":[{"edge_kind":"contacted_ip","from_key":"File:3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","to_key":"Ip:104.21.73.230"},{"edge_kind":"contacted_ip","from_key":"File:3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","to_key":"Ip:172.67.192.176"},{"edge_kind":"contacted_domain","from_key":"File:3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","to_key":"Domain:bakery.moonasbakery.com"},{"edge_kind":"resolves_to","from_key":"Domain:bakery.moonasbakery.com","to_key":"Ip:104.21.73.230"},{"edge_kind":"contacted_domain","from_key":"File:3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","to_key":"Domain:www.google.com"},{"edge_kind":"contacted_url","from_key":"File:3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","to_key":"Url:/r"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","edges":[{"edge_kind":"extracted","from_key":"File:3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","to_key":"File:9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6"},{"edge_kind":"extracted","from_key":"File:3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","to_key":"File:f19cd6c4f11a3332c0af7d10691a5fc0ad2c76dfce2a1aee33137a97a7b98f4d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":87,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":34,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":34,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["windows-server-utility"],"sample_flags":["Network Traffic","TOR analysis","Extracted Files","Simulated analysis"],"sandbox_reports":[{"id":"6aea8beec5f232e9370cce16","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":76,"malware_family":"Malware_60.0","submit_name":"MoonasBakery-v2.0.0.exe","analysis_start_time":"2026-11-04T01:39:13+00:00","indicators_count":{"informative":138,"suspicious":31,"malicious":1},"tags":["Network Traffic","Extracted Files","Simulated analysis"],"is_in_unified_schema":true},{"id":"6aea8bd9e76b3850f7038a3c","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":76,"malware_family":"Malware_60.0","contacted_countries":["USA"],"submit_name":"MoonasBakery-v2.0.0.exe","analysis_start_time":"2026-11-04T01:35:38+00:00","indicators_count":{"informative":143,"suspicious":33,"malicious":1},"tags":["Network Traffic","TOR analysis"],"is_in_unified_schema":true},{"id":"6aea8ab6c9615be337011430","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":76,"malware_family":"Malware_60.0","contacted_countries":["USA"],"submit_name":"MoonasBakery-v2.0.0.exe","analysis_start_time":"2026-11-04T01:30:31+00:00","indicators_count":{"informative":145,"suspicious":39,"malicious":1},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.73.230","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"address":"172.67.192.176","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]}],"dns_resolutions":[{"domain":"bakery.moonasbakery.com","address":"104.21.73.230","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"domain":"www.google.com","country":"-","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]}],"http_requests":[{"host":"bakery.moonasbakery.com","host_ip":"104.21.73.230:443","url":"/r","method":"POST","response_code":"204","response_phrase":"No Content","header":"POST /r HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/json\nUser-Agent: MoonasBakery/2.0.0\nContent-Length: 57\nHost: bakery.moonasbakery.com","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}],"processes":[{"pid":6516,"ppid":0,"name":"MoonasBakery-v2.0.0.exe","command_line":"","sha256":"3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f","normalized_path":"C:\\MoonasBakery-v2.0.0.exe","uid":"00000000-00006516","icon":"$3b"}],"all_imported_dlls":["clbcatq.dll","schannel.dll","CoreUIComponents.dll","WinTypes.dll","rasadhlp.dll","bcrypt.dll","win32u.dll","fltLib.dll","msctf.dll","kernel32.dll","advapi32.dll","ws2_32.dll","oleaut32.dll","IconCodecService.dll","IPHLPAPI.DLL","CoreMessaging.dll","cryptbase.dll","winhttp.dll","webio.dll","shell32.dll","imm32.dll","WindowsCodecs.dll","nsi.dll","SHCore.dll","TextShaping.dll","dpapi.dll","KernelBase.dll","msvcrt.dll","shlwapi.dll","sspicli.dll","gdi32.dll","uxtheme.dll","OnDemandConnRouteHelper.dll","dnsapi.dll","ncrypt.dll","msasn1.dll","user32.dll","combase.dll","ole32.dll","bcryptprimitives.dll","ncryptsslp.dll","sechost.dll","ucrtbase.dll","vcruntime140_1.dll","winnsi.dll","ntmarta.dll","ntdll.dll","vcruntime140.dll","VxSSL64.dll","msvcp140.dll","kernel.appcore.dll","mskeyprotect.dll","rpcrt4.dll","mswsock.dll","FWPUCLNT.DLL","TextInputFramework.dll","ntasn1.dll","gpapi.dll","dwmapi.dll","gdi32full.dll","msvcp_win.dll","cryptsp.dll","crypt32.dll","rsaenh.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","usp10.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","rpcss.dll","api-ms-win-crt-time-l1-1-0.dll","WSHTCPIP.DLL","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","credssp.dll","lpk.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-file-l1-2-0.dll","wship6.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DISMHOST.EXE.6AEAE8F2.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"name":"dism.log","sha256":"f19cd6c4f11a3332c0af7d10691a5fc0ad2c76dfce2a1aee33137a97a7b98f4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"key":"HKCUHKCU\\SOFTWARE\\MOONA'S BAKERY\\","sources":[{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"},{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MoonasBakeryLoader","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6516:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6516:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"name":"Local\\SM0:6516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"name":"SM0:6516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"name":"MoonasBakeryLoader","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"},{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"name":"SM0:6516:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"name":"Local\\SM0:6516:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea8ab6c9615be337011430"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"name":"Local\\SM0:1932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"name":"SM0:1932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea8bd9e76b3850f7038a3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MoonasBakeryLoader","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]},{"name":"Local\\MoonasBakeryLoader","sources":[{"report_type":"sandbox","report_id":"6aea8beec5f232e9370cce16"}]}]}},"report_ids":{"sandbox_job_ids":["6aea8ab6c9615be337011430","6aea8beec5f232e9370cce16","6aea8bd9e76b3850f7038a3c"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware_60.0 Sample 3c679cbf1597… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3c679cbf1597…. Malware family: Malware_60.0. Threat score 76/100. 1/25 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware_60.0 Sample 3c679cbf1597… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3c679cbf1597…. Malware family: Malware_60.0. Threat score 76/100. 1/25 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3c679cbf1597f8e2465ae75a018f2638af055ca96b63987f123db591eb70b19f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware_60.0 Sample 3c679cbf1597… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3c679cbf1597…. Malware family: Malware_60.0. Threat score 76/100. 1/25 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]]