24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Trojan.Agent Sample 457f73f71547… — Score 60/100 — Hybrid Analysis","description":"Suspicious verdict for sample 457f73f71547…. Malware family: Trojan.Agent. Threat score 60/100. 1/28 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91","keywords":["Suspicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91"],"about":{"@type":"SoftwareApplication","name":"Set-up.exe","applicationCategory":["peexe","executable"],"identifier":"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91","additionalType":"Suspicious sample"},"threatScore":60,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7c2,"Set-up.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Set-up.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Set-up.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Set-up.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Set-up.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Set-up.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Set-up.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Set-up.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "Set-up.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "Set-up.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "")26:T867,"Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Set-up.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")27:T185d,Pattern match: "http://www.winimage.com/zLibDll" Pattern match: "jquery.org/license" Heuristic match: "n(e){return e==null?:e+})),n=v.valHooks[this.type]||v.valHooks[this.nodeName.toLowerCase()];if(!n||!(setin n)||n.set(this,s,value)===t)this.value=s})}}),v.extend({valHooks:{option:{get:function(e){var t=e.attributes.value;return!t||t.specified?e.va" Heuristic match: "),u=u.replace(dt,<$1>),a=(vt.exec(u)||[,])[1].toLowerCase(),f=Nt[a]||Nt._default,l=f[0],c.innerHTML=f[1]+u+f[2];while(l--)c=c.lastChild;if(!v.support.tbody){h=mt.test(u),p=a===table&&!h?c.firstChild&&c.firstChild.childNodes:f[1]===&&!" Heuristic match: ");this.elementTouchend=function(i){e.stopTouchScrolling(i)};this.scrollable.$element[0].addEventListener(touchend,this.elementTouchend)}},removeTouchScrolling:function(){if(document.addEventListener){this.scrollable.$element[0].removeEventListener(touch" Heuristic match: "ction(){if(i==undefined)i=o;if(typeof i==string){var n=e(this).data(scrollable);if(n)n[i](t)}else if(typeof i==object){i=e.extend(o,i);new s(e(this),i)}else throwInvalid type of options})}})(jQuery);(function(e){var i=[DOMMouseScroll,mousewheel" Pattern match: "http://www.adobe.com/products/eulas/tou_typekit" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "https://sqe-prstg-ffc.oobesaas.adobe.com/adobe-ffc-external" Pattern match: "https://qe-prstg-ffc.oobesaas.adobe.com/adobe-ffc-external" Pattern match: "https://prod-rel-ffc-ccm.oobesaas.adobe.com/adobe-ffc-external" Pattern match: "https://cdn-stg-ffc.oobesaas.adobe.com" Pattern match: "https://cdn-qe-ffc.oobesaas.adobe.com" Pattern match: "https://cdn-ffc.oobesaas.adobe.com" Pattern match: "https://cdn-ffc.oobesaas.adobe.com/core/v2/applications" Pattern match: "https://cdn-ffc.oobesaas.adobe.com/core/v3/applications" Pattern match: "https://cdn-ffc.oobesaas.adobe.com/core/v1/validation" Pattern match: "https://cdn-ffc.oobesaas.adobe.com/core/v4/products/all" Pattern match: "https://cdn-ffc.oobesaas.adobe.com/core/v1/update/description" Heuristic match: "ims-prod07.adobelogin.com" Heuristic match: "ims-na1-stg1.adobelogin.com" Heuristic match: "ims-na1-dev1.adobelogin.com" Heuristic match: "ims-na1-dev2.adobelogin.com" Heuristic match: "ims-na1-qa1.adobelogin.com" Heuristic match: "ims-na1-qa2.adobelogin.com" Pattern match: "https://oobe.adobe.com/" Pattern match: "https://tron-prod-customized-user-packages.s3-accelerate.amazonaws.com" Pattern match: "https://tron-prod-customized-user-packages.s3.amazonaws.com" Pattern match: "https://tronstageuserpackages.s3-accelerate.amazonaws.com" Pattern match: "https://tronstageuserpackages.s3.amazonaws.com" Pattern match: "https://tron-qe-user-packages.s3-accelerate.amazonaws.com" Pattern match: "https://tron-qe-user-packages.s3.amazonaws.com" Pattern match: "https://trondevuserpackages.s3-accelerate.amazonaws.com" Pattern match: "https://trondevuserpackages.s3.amazonaws.com" Pattern match: "https://stage.adminconsole.adobe.com" Pattern match: "https://adminconsole.adobe.com" Pattern match: "https://tron-onesie-dev.corp.adobe.com" Pattern match: "https://qa.adminconsole.adobe.com" Pattern match: "https://tron-onesie.corp.adobe.com" Pattern match: "https://www.adobe.com/" Pattern match: "https://oobe.adobe.com/type3" Heuristic match: "ACCC.OOBEUTILS.HTTPCONNECTOR.LOCK.ID" Heuristic match: "na1e-acc.services.adobe.com" Heuristic match: "ccmdl.adobe.com" Heuristic match: "stage-ffc-files.corp.adobe.com" Pattern match: "https://helpx.adobe.com/x-productkb/global/desktop-app-usage-information-faq.html" Pattern match: "https://www.adobe.com/creativecloud/desktop-app.html" Pattern match: "www.adobe.com/go/download-packager-utility" Pattern match: "https://helpx.adobe.com/de/x-productkb/global/desktop-app-usage-information-faq.html" Pattern match: "https://www.adobe.com/de/creativecloud/desktop-app.html" Pattern match: "https://www.adobe.com/go/download-packager-utility_de" Pattern match: "https://helpx.adobe.com/fr/x-productkb/global/desktop-app-usage-information-faq.html" Pattern match: "http://www.adobe.com/go/system_requirements_hdesd_fr" Pattern match: "https://www.adobe.com/fr/creativecloud/desktop-app.html" Pattern match: "https://www.adobe.com/go/download-packager-utility_fr" Pattern match: "https://helpx.adobe.com/jp/x-productkb/global/desktop-app-usage-information-faq.html" Pattern match: "http://www.adobe.com/go/system_requirements_hdesd_jp" Pattern match: "https://www.adobe.com/jp/creativecloud/desktop-app.html" Pattern match: "https://www.adobe.com/go/download-packager-utility_jp" Pattern match: "https://helpx.adobe.com/es/x-productkb/global/desktop-app-usage-information-faq.html" Pattern match: "https://www.adobe.com/es/creativecloud/desktop-app.html" Pattern match: "https://www.adobe.com/go/download-packager-utility_es" Pattern match: "https://helpx.adobe.com/br/x-productkb/global/desktop-app-usage-information-faq.html" Pattern match: "https://www.adobe.com/br/creativecloud/desktop-app.html" Pattern match: "https://www.adobe.com/go/download-packager-utility_br" Pattern match: "https://helpx.adobe.com/kr/x-productkb/global/desktop-app-usage-information-faq.html" Pattern match: "http://www.adobe.com/go/system_requirements_hdesd_kr" Pattern match: "https://www.adobe.com/kr/creativecloud/desktop-app.html" Pattern match: "https://www.adobe.com/go/download-packager-utility_kr" Pattern match: "https://helpx.adobe.com/it/x-productkb/global/desktop-app-usage-information-faq.html" Pattern match: "https://www.adobe.com/it/creativecloud/desktop-app.html" Pattern match: "https://www.adobe.com/go/download-packager-utility_it" Pattern match: "https://helpx.adobe.com/cn/x-productkb/global/desktop-app-usage-information-faq.html" Pattern match: "http://www.adobe.com/go/system_requirements_hdesd_cn" Pattern match: "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s" Pattern match: "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHv"28:Td54,"ProductInstallationgenericExtractionErr" (Indicator: "icext") "ProductUpdategenericExtractionErr" (Indicator: "icext") "{10}customer support{11}." } "ProductInstallationmaxPathErr2": { "message": "Download path is too long. Please contact {10}customer support{11}." } "ProductInstallationgenericExtractionErr": { "message": "We are unable to complete the installation this time." } "ProductUpdategenericExtractionErr": { "message": "We are unable to complete the update this time." } "ProductInstallationaccessPermissionErrNew": { "message": "We are unable to install {0} in the selected location due to permission issues. Please change location." } "ProductUpdateaccessPermissionErrNew": { "message": "We are unable to update {0} in the selected location due to permission issues. Please grant access to SYSTEM at the install location." } "ProductInstallationTitleConflict": { "message": "Installation conflict" } "ProductUpdateTitleConflict": { "message": "Update conflict" } "ProductUnInsta" (Indicator: "icext") "ren Verzeichnis aktualisiert werden. Wenden Sie sich an den {10}Support{11}." } "ProductInstallationmaxPathErr2": { "message": "Der Downloadpfad ist zu lang. Wenden Sie sich an den {10}Support{11}." } "ProductInstallationgenericExtractionErr": { "message": "Die Installation kann momentan nicht abgeschlossen werden." } "ProductUpdategenericExtractionErr": { "message": "Die Aktualisierung kann momentan nicht abgeschlossen werden." } "ProductInstallationaccessPermissionErrNew": { "message": "Aufgrund von Berechtigungsproblemen kann {0} am ausgew" (Indicator: "icext") "le{11}." } "ProductInstallationgenericExtractionErr": { "message": "Impossible de finaliser l" (Indicator: "icext") "installation pour le moment." } "ProductUpdategenericExtractionErr": { "message": "Impossible de finaliser la mise" (Indicator: "icext") "" } "ProductInstallationgenericExtractionErr": { "message": "" (Indicator: "icext") "" } "ProductUpdategenericExtractionErr": { "message": "" (Indicator: "icext") "ngase en contacto con el servicio de {10}Asistencia al cliente{11}." } "ProductInstallationgenericExtractionErr": { "message": "No se ha podido completar la instalaci" (Indicator: "icext") "n esta vez." } "ProductUpdategenericExtractionErr": { "message": "Esta vez no se ha podido completar la actualizaci" (Indicator: "icext") "muito longo. Entre em contato com o {10}suporte ao cliente{11}." } "ProductInstallationgenericExtractionErr": { "message": "No momento, n" (Indicator: "icext") "o." } "ProductUpdategenericExtractionErr": { "message": "No momento, n" (Indicator: "icext") "." } "ProductInstallationgenericExtractionErr": { "message": "" (Indicator: "icext") "." } "ProductUpdategenericExtractionErr": { "message": "" (Indicator: "icext") "{10}Assistenza clienti{11}." } "ProductInstallationgenericExtractionErr": { "message": "Impossibile completare l'installazione al momento." } "ProductUpdategenericExtractionErr": { "message": "Impossibile completare l" (Indicator: "icext")29:Ta85,"Set-up.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 1965312) "Set-up.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1957889) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1957889) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1965313) "Set-up.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1965313)2a:T8da,"Set-up.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "Set-up.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "Set-up.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Set-up.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "Set-up.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "Set-up.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Set-up.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "Set-up.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "Set-up.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "Set-up.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "Set-up.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "Set-up.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "Set-up.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "Set-up.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "Set-up.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "Set-up.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "Set-up.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "Set-up.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "Set-up.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "Set-up.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS")2b:T432,RegCreateKeyExW RegCloseKey SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW GetUserNameW GetDriveTypeW GetFileAttributesA LockResource GetFileAttributesW UnhandledExceptionFilter GetTempPathA FindResourceExW ConnectNamedPipe OutputDebugStringA CopyFileW OutputDebugStringW GetModuleFileNameW IsDebuggerPresent GetVersionExA LoadLibraryA LoadLibraryExA LoadLibraryExW CreateThread ExitThread TerminateProcess GetModuleHandleExW CreateToolhelp32Snapshot LoadLibraryW GetVersionExW GetTickCount VirtualProtect GetFileSize OpenProcess DeleteFileA GetStartupInfoW CreateDirectoryW DeleteFileW GetProcAddress CreateFileMappingW WriteFile GetFileSizeEx FindNextFileW CreateFileMappingA FindFirstFileW FindFirstFileExW GetTempPathW CreateFileW CreateFileA Sleep Process32NextW GetCommandLineW GetCommandLineA Process32FirstW MapViewOfFile GetModuleHandleA GetModuleHandleW GetFileAttributesExW FindResourceW CreateProcessW GetComputerNameExW VirtualAlloc ShellExecuteW ShellExecuteExW GetWindowThreadProcessId2c:T9b7,"Set-up.exe" wrote bytes "d83a7c74" to virtual address "0x747D01E0" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "b4367c74" to virtual address "0x747D025C" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "b4367c74" to virtual address "0x747D0278" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "c0dff2761cf9f176ccf8f1760d64f37600000000c0110e7600000000fc3e0e7600000000e0130e76000000009457087625e0f276c6e0f27600000000bc6a077600000000cf310e760000000093190876000000002c320e7600000000" to virtual address "0x761E1000" (part of module "NSI.DLL") "Set-up.exe" wrote bytes "b4367c74" to virtual address "0x747D01E4" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "d83a7c74" to virtual address "0x747D0258" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "d83a7c74" to virtual address "0x747D0274" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "b890127d73ffe0" to virtual address "0x747C3AD8" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "d83a0200" to virtual address "0x747C4E38" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "b4360200" to virtual address "0x747C4D68" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "68130000" to virtual address "0x76AC1680" (part of module "WS2_32.DLL") "Set-up.exe" wrote bytes "b880117d73ffe0" to virtual address "0x76AC1368" (part of module "WS2_32.DLL") "Set-up.exe" wrote bytes "0efcf57681edf476ae86f376c6e0f276effdf5762d16f476c0fcf176da8ffc766014f676478df376a8e2f2766089f37600000000ad37ac768b2dac76b641ac7600000000" to virtual address "0x73541000" (part of module "WSHIP6.DLL") "Set-up.exe" wrote bytes "a0117d73" to virtual address "0x73824028" (part of module "WEBIO.DLL") "Set-up.exe" wrote bytes "b4360200" to virtual address "0x747C4EA4" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "b4367c74" to virtual address "0x747D0200" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "7111ad007a3bac00ab8b02007f950200fc8c0200729602006cc805001ecda9007d26a900" to virtual address "0x764B07E4" (part of module "USER32.DLL") "Set-up.exe" wrote bytes "7d07f67681edf476ae86f376c6e0f276effdf5762d16f4766014f676478df376a8e2f2766089f37600000000ad37ac768b2dac76b641ac7600000000" to virtual address "0x735E1000" (part of module "WSHTCPIP.DLL") "Set-up.exe" wrote bytes "d83a7c74" to virtual address "0x747D01FC" (part of module "SSPICLI.DLL") "Set-up.exe" wrote bytes "b810157d73ffe0" to virtual address "0x747C36B4" (part of module "SSPICLI.DLL")2d:T58a,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "Set-up.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Set-up.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")2e:T6e9,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "Set-up.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "Set-up.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "Set-up.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")2f:T6c4,Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "Set-up.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Set-up.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Set-up.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "Set-up.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")30:T6d4,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "Set-up.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "Set-up.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/F" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "Set-up.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/F" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "Set-up.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp, 00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp, 00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/F" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/F" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")31:T7ea,Found reference to API "Failed in getSignatureOfData-CryptHashData with error %d" (Indicator: "CryptHashData"; File: "Set-up.bin") Found reference to API "Failed in getSignatureOfData-CryptCreateHash with error %d" (Indicator: "CryptCreateHash"; File: "Set-up.bin") Found reference to API "Failed in getSignatureOfData-CryptAcquireContext with error %d" (Indicator: "CryptAcquireContext"; File: "Set-up.bin") Found reference to API "Failed in getSignatureOfData-CryptGetHashParam with error %d" (Indicator: "CryptGetHashParam"; File: "Set-up.bin") Found reference to API "eOfData-CryptHashData with error %d" (Indicator: "CryptHashData"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "ata-CryptAcquireContext with error %d" (Indicator: "CryptAcquireContext"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "ureOfData-CryptGetHashParam with error %d" (Indicator: "CryptGetHashParam"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")32:Td96,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "2BrBFlJbvzLXU1bGW08VysJ2wQUj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHvX7K0Gf17ibCk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHvX7K0Gf17ibCk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHvX7K0Gf17ibCk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHvX7K0Gf17ibCk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHvX7K0Gf17ibCk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHvX7K0Gf17ibCk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com"33:T40b,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Found encryption key used by malware in binary Matched sigs: Contains reference to cryptographic keys Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: YARA signature match - AES Encryption Matched sigs: YARA signature match - Cryptography Rijndael Matched sigs: YARA signature match - RC4 Encryption34:T9f6,".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000fe021889fd020a000000000000002000000000009e00cc019e00dc0a9e0000000000d80a9e00409cff02f8f9cf005916b277200000000000000088facf000000fd020800000028000000000000000000000005000000020000000000fd0220000000000000000000000018facf00ee13b27707000000ee13b27700000000000000002000000088facf0030facf0075b357000000fd0200000000200000000f0000003cfacf001e0f5400200000001000000088facf0051493a0008fefe02908a5e00100000004ab25c00289cff02bcfacf00908a5e000800000008fefe02b0facf001d1b4e00289cff026b1b4e00be8911bb289bff02220000000000fe02 (UID: 00000000-00007060) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000004c18000094f200010000000000000001805d0003805d00030a000000c6f20873ff07000000000000885d0003ff070000ffffffffff0001fffeffffff00000000d864fd029791b277d086bf01000000004b160000ffffff00d864fd027f0700007f0700004b1600007f0700000000ec720000000028decf00506ab577c9f15257feffffff78ddcf00b716b2770010000008100000f06bfd0264ddcf000000ec720000fd020100000008100000000000000000000001020000030000000000fd020010000008000000a8ddcf009cddcf00ee13b27701000000ee13b2770800000000000000000000000800000028decf00ccddcf0025abf2720000fd02 (UID: 00000000-00007060) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007060) ".exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007060)35:T424,Found string "select * from sqlite_master" (Indicator: "select * from "; File: "Set-up.bin") Found string "SELECT * from opm_data" (Indicator: "select * from "; File: "Set-up.bin") Found string "SELECT * FROM opm_user WHERE key LIKE "" (Indicator: "select * from "; File: "Set-up.bin"), Found string "select * from sqlite_master" (Indicator: "select * from "; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp"), Found string "SELECT * from opm_data" (Indicator: "select * from "; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp"), Found string "SELECT * FROM opm_user WHERE key LIKE "" (Indicator: "select * from "; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found string "SELECT * FROM Win32_DiskDrive where interfaceType != 'USB'" (Indicator: "select * from "; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found string "SELECT * FROM Win32_DiskDrive where interfaceType = 'USB'" (Indicator: "select * from "; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")36:T637,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "Set-up.bin") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "Set-up.bin") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "Set-up.bin") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")37:T510,Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "Set-up.bin") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "Set-up.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Set-up.bin") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "Set-up.bin") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")38:T601,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "Set-up.bin") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "3880357988,6820,109,,GetWindowTextW,user32.dll,"00:19:40.312",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp")39:T5bc,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "Set-up.bin") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "Set-up.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "Set-up.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "Set-up.bin") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")3a:T748,".exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")3b:T484,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007060) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007060) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007060) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007060) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007060) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007060) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007060) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.dll (UID: 00000000-00007060) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00007060) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007060)3c:T15b0,".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007060) ".exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007060)3d:T44d,Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; File: "Set-up.bin") Found reference to API "Privilege lowering failed PU_CreateProcessWithTokenW! Error: %u" (Indicator: "CreateProcess"; File: "Set-up.bin") Found reference to API "CreateProcess failed! Error: %u" (Indicator: "CreateProcess"; File: "Set-up.bin") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "Privilege lowering failed PU_CreateProcessWithTokenW! Error: %u" (Indicator: "CreateProcess"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateProcess failed! Error: %u" (Indicator: "CreateProcess"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")3e:T6cb,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "Set-up.bin") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "Set-up.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "Set-up.bin") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "Set-up.bin") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "Set-up.bin") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; File: "Set-up.bin") Found reference to API "Failed to CreateFilePath: %s. %s" (Indicator: "CreateFile"; File: "Set-up.bin") Found reference to API "CreateFilePath: %s. %s" (Indicator: "CreateFile"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "Failed to CreateFilePath: %s. %s" (Indicator: "CreateFile"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")3f:T540,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")40:T4db,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "Set-up.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "Set-up.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "Set-up.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")41:T101d,"HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Identity\UserSpecificIdentity" in Source: Set-up.bin "SOFTWARE\Microsoft\Cryptography" in Source: Set-up.bin "SOFTWARE\Microsoft\Internet Explorer" in Source: Set-up.bin "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: Set-up.bin "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: Set-up.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: Set-up.bin "Software\Adobe\ALCID" in Source: Set-up.bin "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00007060.00000000.75739.005A6000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer" in Source: 00000000-00007060.00000000.75739.005A6000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00007060.00000000.75739.005A6000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007060.00000000.75739.005A6000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007060.00000000.75739.005A6000.00000002.mdmp "Software\Adobe\ALCID" in Source: 00000000-00007060.00000000.75739.005A6000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Identity\UserSpecificIdentity" in Source: 00000000-00007060.00000000.75739.005A6000.00000002.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\App Managementent}df" in Source: 00000000-00007060.00000000.75739.00968000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\App Management" in Source: 00000000-00007060.00000000.75739.02EE0000.00000004.mdmp "7261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00007060.00000000.75739.02EE0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Window" in Source: 00000000-00007060.00000000.75739.02EE5000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00007060.00000000.75739.02EE5000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007060.00000000.75739.02FD0000.00000004.mdmp "Y\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00007060.00000000.75739.04CF0000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" in Source: 00000000-00007060.00000000.75739.05718000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\" in Source: 00000000-00007060.00000000.75739.05718000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007060.00000000.75739.7EAA0000.00000002.mdmp42:T51e,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4997 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 22 Aug 2023 16:30:02 GMT Last-Modified: Tue 22 Aug 2023 15:06:45 GMT Server: ECAcc (saa/8372) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHvX7K0Gf17ibCk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5530 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 22 Aug 2023 16:30:02 GMT Last-Modified: Tue 22 Aug 2023 14:57:52 GMT Server: ECAcc (saa/838F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148FE87EF06D326A000523C770976A3A90FF6BEAD4180F32.......43:Tc6b,".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74d00000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74d00000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74d00000 ".exe" loaded module "KERNEL32" at base 75be0000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 ".exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74d00000 ".exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74d00000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74d00000 ".exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75be0000 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f90000 ".exe" loaded module "KERNEL32.DLL" at base 75be0000 ".exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 74d00000 ".exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 72ec0000 ".exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76260000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73c60000 ".exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 759f0000 ".exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75be0000 ".exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74590000 ".exe" loaded module "CRYPT32.DLL" at base 759f0000 ".exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 73c10000 ".exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 73c10000 ".exe" loaded module "RPCRT4.DLL" at base 77a20000 ".exe" loaded module "WINHTTP.DLL" at base 72e10000 ".exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73be0000 ".exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73f10000 ".exe" loaded module "SSPICLI.DLL" at base 74500000 ".exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72d80000 ".exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72d30000 ".exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72d10000 ".exe" loaded module "CRYPTNET.DLL" at base 73c10000 ".exe" loaded module "COMCTL32.DLL" at base 735d0000 ".exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75540000 ".exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74600000 ".exe" loaded module "OLEAUT32.DLL" at base 762b0000 ".exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76510000 ".exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76510000 ".exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 75790000 ".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 745f000044:T2cc0,"SELECT * FROM" (Source: Set-up.bin, Indicator: "select * from") "INSERT INTO product_installation_info_new ( SAPCode, ProductVersion, Status ) SELECT SAPCode, ProductVersion, Status FROM product_installation_info" (Source: Set-up.bin, Indicator: "insert into product_installation_info_new ( sapcode, productversion, status ) select sapcode productversion status from product_installation_info"), "CREATE TABLE product_installation_info_new ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) Status INT constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily) )" (Source: Set-up.bin, Indicator: "create table product_installation_info_new ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) status int constraint pk primary key (sapcode, productversion, processorfamily) )"), "CREATE TABLE product_installation_meta_info_new ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) Key TEXT Value TEXT constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily, Key) )" (Source: Set-up.bin, Indicator: "create table product_installation_meta_info_new ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) key text value text constraint pk primary key (sapcode, productversion, processorfamily, key) )"), "INSERT INTO product_installation_meta_info_new ( SAPCode, ProductVersion, Key, Value ) SELECT SAPCode ProductVersion Key Value FROM product_installation_meta_info" (Source: Set-up.bin, Indicator: "insert into product_installation_meta_info_new ( sapcode, productversion, key, value ) select sapcode productversion key value from product_installation_meta_info"), "INSERT INTO package_installation_info_new ( SAPCode, ProductVersion, PackageName, PackageVersion ) SELECT SAPCode ProductVersion PackageName PackageVersion FROM package_installation_info" (Source: Set-up.bin, Indicator: "insert into package_installation_info_new ( sapcode, productversion, packagename, packageversion ) select sapcode productversion packagename packageversion from package_installation_info"), "CREATE TABLE package_installation_info_new ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) PackageName varchar(36) PackageVersion varchar(36) constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily, PackageName, PackageVersion) )" (Source: Set-up.bin, Indicator: "create table package_installation_info_new ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) packagename varchar(36) packageversion varchar(36) constraint pk primary key (sapcode, productversion, processorfamily, packagename, packageversion) )"), "CREATE TABLE package_installation_meta_info_new ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) PackageName varchar(36) PackageVersion varchar(36) Key TEXT Value TEXT constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily, PackageName, PackageVersion, Key) )" (Source: Set-up.bin, Indicator: "create table package_installation_meta_info_new ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) packagename varchar(36) packageversion varchar(36) key text value text constraint pk primary key (sapcode, productversion, processorfamily, packagename, packageversion, key) )"), "INSERT INTO package_installation_meta_info_new ( SAPCode, ProductVersion, PackageName, PackageVersion, Key, Value ) SELECT SAPCode ProductVersion PackageName PackageVersion Key Value FROM package_installation_meta_info" (Source: Set-up.bin, Indicator: "insert into package_installation_meta_info_new ( sapcode, productversion, packagename, packageversion, key, value ) select sapcode productversion packagename packageversion key value from package_installation_meta_info"), "INSERT INTO product_reference_info_new ( SAPCode, ProductVersion, ReferencingSAPCode, ReferencingProductVersion, Type ) SELECT SAPCode ProductVersion ReferencingSAPCode ReferencingProductVersion Type FROM product_reference_info" (Source: Set-up.bin, Indicator: "insert into product_reference_info_new ( sapcode, productversion, referencingsapcode, referencingproductversion, type ) select sapcode productversion referencingsapcode referencingproductversion type from product_reference_info"), "CREATE TABLE product_reference_info_new ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) ReferencingSAPCode varchar(36) ReferencingProductVersion varchar(36) ReferencingProcessorFamily varchar(36) Type varchar constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily, ReferencingSAPCode, ReferencingProductVersion, ReferencingProcessorFamily) )" (Source: Set-up.bin, Indicator: "create table product_reference_info_new ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) referencingsapcode varchar(36) referencingproductversion varchar(36) referencingprocessorfamily varchar(36) type varchar constraint pk primary key (sapcode, productversion, processorfamily, referencingsapcode, referencingproductversion, referencingprocessorfamily) )"), "INSERT INTO Package_reference_info_new ( PackageName, PackageVersion, SAPCode, ProductVersion, Type ) SELECT PackageName PackageVersion SAPCode ProductVersion Type FROM Package_reference_info" (Source: Set-up.bin, Indicator: "insert into package_reference_info_new ( packagename, packageversion, sapcode, productversion, type ) select packagename packageversion sapcode productversion type from package_reference_info"), "CREATE TABLE Package_reference_info_new ( PackageName varchar(36) PackageVersion varchar(36) SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) Type TEXT constraint pk PRIMARY KEY (PackageName, PackageVersion, SAPCode, ProductVersion, ProcessorFamily) )" (Source: Set-up.bin, Indicator: "create table package_reference_info_new ( packagename varchar(36) packageversion varchar(36) sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) type text constraint pk primary key (packagename, packageversion, sapcode, productversion, processorfamily) )"), "CREATE TABLE user_action_info_new ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) Action TEXT TimeOfAction TEXT constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily, Action, TimeOfAction) )" (Source: Set-up.bin, Indicator: "create table user_action_info_new ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) action text timeofaction text constraint pk primary key (sapcode, productversion, processorfamily, action, timeofaction) )"), "INSERT INTO user_action_info_new ( SAPCode, ProductVersion, Action, TimeOfAction ) SELECT SAPCode ProductVersion Action TimeOfAction FROM user_action_info" (Source: Set-up.bin, Indicator: "insert into user_action_info_new ( sapcode, productversion, action, timeofaction ) select sapcode productversion action timeofaction from user_action_info"), "INSERT OR REPLACE INTO" (Source: Set-up.bin, Indicator: "insert or replace into"), "select count(*) from sqlite_master" (Source: Set-up.bin, Indicator: "select count(*) from sqlite_master"), "select count(*) from pim_meta" (Source: Set-up.bin, Indicator: "select count(*) from pim_meta"), "CREATE TABLE product_installation_info ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) Status INT constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily) )" (Source: Set-up.bin, Indicator: "create table product_installation_info ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) status int constraint pk primary key (sapcode, productversion, processorfamily) )"), "CREATE TABLE product_installation_meta_info ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) Key TEXT Value TEXT constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily, Key) )" (Source: Set-up.bin, Indicator: "create table product_installation_meta_info ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) key text value text constraint pk primary key (sapcode, productversion, processorfamily, key) )"), "CREATE TABLE package_installation_info ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) PackageName varchar(36) PackageVersion varchar(36) constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily, PackageName, PackageVersion) )" (Source: Set-up.bin, Indicator: "create table package_installation_info ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) packagename varchar(36) packageversion varchar(36) constraint pk primary key (sapcode, productversion, processorfamily, packagename, packageversion) )"), "CREATE TABLE product_reference_info ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) ReferencingSAPCode varchar(36) ReferencingProductVersion varchar(36) ReferencingProcessorFamily varchar(36) Type varchar constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily, ReferencingSAPCode, ReferencingProductVersion, ReferencingProcessorFamily) )" (Source: Set-up.bin, Indicator: "create table product_reference_info ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) referencingsapcode varchar(36) referencingproductversion varchar(36) referencingprocessorfamily varchar(36) type varchar constraint pk primary key (sapcode, productversion, processorfamily, referencingsapcode, referencingproductversion, referencingprocessorfamily) )"), "CREATE TABLE package_installation_meta_info ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) PackageName varchar(36) PackageVersion varchar(36) Key TEXT Value TEXT constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily, PackageName, PackageVersion, Key) )" (Source: Set-up.bin, Indicator: "create table package_installation_meta_info ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) packagename varchar(36) packageversion varchar(36) key text value text constraint pk primary key (sapcode, productversion, processorfamily, packagename, packageversion, key) )"), "CREATE TABLE user_action_info ( SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) Action TEXT TimeOfAction TEXT constraint pk PRIMARY KEY (SAPCode, ProductVersion, ProcessorFamily, Action, TimeOfAction) )" (Source: Set-up.bin, Indicator: "create table user_action_info ( sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) action text timeofaction text constraint pk primary key (sapcode, productversion, processorfamily, action, timeofaction) )"), "CREATE TABLE Package_reference_info ( PackageName varchar(36) PackageVersion varchar(36) SAPCode varchar(36) ProductVersion varchar(36) ProcessorFamily varchar(36) Type TEXT constraint pk PRIMARY KEY (PackageName, PackageVersion, SAPCode, ProductVersion, ProcessorFamily) )" (Source: Set-up.bin, Indicator: "create table package_reference_info ( packagename varchar(36) packageversion varchar(36) sapcode varchar(36) productversion varchar(36) processorfamily varchar(36) type text constraint pk primary key (packagename, packageversion, sapcode, productversion, processorfamily) )")45:T728,".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "")46:Tb38,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSETTINGSPERUSER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "DEFAULTCONNECTIONSETTINGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: "LOCAL APPDATA"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "PROFILEIMAGEPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGFLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "")47:Tae7,".exe" trying to access non-existent file "C:\SET-UP.EXE.LOCAL" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\OOBE.TRACE" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\OOBE.trace" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\OOBE.DEBUG" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\OOBE.debug" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ASU.TRACE" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asu.trace" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ASU.DEBUG" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asu.debug" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDINSTALLER.LOG" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\ASU.TRACE" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_3F584A3392BB586FC541F0F81FC9D443" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2659C1A560AB92C9C29D4B2B25815AE8" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0270780F846F08BEFE0DD8112D932FEF" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_4C35F1EE5966309704301FF08936B40A" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\782AC1F7D5B160B0F71F6F92B0912799" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6E47DC54834F661FE77B461D2DF73D9D"48:Tae5,Found reference to API "Error %u in WinHttpReadData." (Indicator: "WinHttpReadData"; File: "Set-up.bin") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "Error %u in WinHttpReadData." (Indicator: "WinHttpReadData"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")49:Ted7,Found reference to API "Error %d in WinHttpQueryDataAvailable." (Indicator: "WinHttpQueryDataAvailable"; File: "Set-up.bin") Found reference to API "Error %u in WinHttpReadData." (Indicator: "WinHttpReadData"; File: "Set-up.bin") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "Error %d in WinHttpQueryDataAvailable." (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "Error %u in WinHttpReadData." (Indicator: "WinHttpReadData"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp")4a:T3d1d,Found URL "https://sqe-prstg-ffc.oobesaas.adobe.com/adobe-ffc-externalhttps://qe-prstg-ffc.oobesaas.adobe.com/adobe-ffc-externalhttps://prod-rel-ffc-ccm.oobesaas.adobe.com/adobe-ffc-externalhttps://cdn-stg-ffc.oobesaas.adobe.comhttps://cdn-qe-ffc.oobesaas.adobe.comhttps://cdn-ffc.oobesaas.adobe.com/core/v1/applications/core/v4/products/allnamewin32platformwin64osversionthe" - Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found URL "https://cdn-ffc.oobesaas.adobe.com/core/v2/applicationshttps://cdn-ffc.oobesaas.adobe.com/core/v3/applicationshttps://cdn-ffc.oobesaas.adobe.com/core/v1/validationhttps://cdn-ffc.oobesaas.adobe.com/core/v4/products/all?https://cdn-ffc.oobesaas.adobe.com/core/v1/update/descriptionhdpimhelperutilsfailed" - Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found URL "https:///ims/token/v1postgrant_type=device&device_id=&device_token=&client_id=&client_secret=&scope=&locale=content-typeapplication/x-www-form-urlencodedsendhttprequest" - Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found URL "https://oobe.adobe.com/&force_marketing_permission=truefailed" - Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found URL "https://tron-prod-customized-user-packages.s3-accelerate.amazonaws.comhttps://tron-prod-customized-user-packages.s3.amazonaws.comhttps://tronstageuserpackages.s3-accelerate.amazonaws.comhttps://tronstageuserpackages.s3.amazonaws.comhttps://tron-qe-user-packages.s3-accelerate.amazonaws.comhttps://tron-qe-user-packages.s3.amazonaws.comhttps://trondevuserpackages.s3-accelerate.amazonaws.comhttps://trondevuserpackages.s3.amazonaws.comhttps://stage.adminconsole.adobe.comhttps://adminconsole.adobe.comhttps://tron-onesie-dev.corp.adobe.comhttps://qa.adminconsole.adobe.comsanity" - Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found URL "https://tron-onesie.corp.adobe.comsanity" - Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found URL "https://www.adobe.com/\adobe\oobe\/messagedataerrorcode/messagedata/errordatamoreinfolinkisresumableprogresspercentageerrordetail" - Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found URL "https://oobe.adobe.com/delegation_enddelegation_startsign-in" - Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found URL "https://oobe.adobe.com/type3?device_token=connectingto?redirect_uri=imstype3htmlloadcomplete:" - Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found URL "http://failed" - Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdll" - Source: "00000000-00007060.00000000.75739.005A6000.00000002.mdmp") Found URL "http://crlp.digicert.com/ocsp.digicert.comcalrpccalrpccalrpccalrpccalrpctsvcscalrpctsvcscalrpcredsspcalrpcssspku2udigestcsp:http://ocsp.digicert.comhttp://crl3.digicert.com/digicerthighassuranceevrootca.crlhttp://crl4.digicert.com/digicerthighassuranceevrootca.crladobe" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://crl3.digicert.com/evcodesigningsha2-g1.crlhttp://crl4.digicert.com/evcodesigningsha2-g1.crl12799crl4.digicert.com:\users\hapubws\appdata\local\temploopback" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbspwl%2brbfljbvzlxu1bgw08vysj%2bh%2b8g0yagafi8dwl2o6kp9r6tqceabytz9nshvx7k0gf17ibck%3dfp2e7a.wpc.phicdn.netcrl.edge.digicert.comfp2e7a.wpc.2be4.8n.netcrl3.digicert.comcrl.edge.digicert.com4.digibhttp://crl4.digicert.com/evcodesigningsha2-g1.crlsigningsha2-g1.crlcrl3.digicert.comfp2e7a.wpc.phicdn.netocsp.digicert.comers\hapubwstppda890a3478f90a8c88b266c6ff99a97gungsuhchemsmincho.ttc" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://crl3.digicert.com/evcodesigningsha2-g1.crl??\c:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\content\782ac1f7d5b160b0f71f6f92b0912799:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\he" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://crl4.digicert.com/evcodesigningsha2-g1.crl??\c:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\content\6e47dc54834f661fe77b461d2df73d9d:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\??\c:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\metadata\782ac1f7d5b160b0f71f6f92b0912799nirmala" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://crl3.digicert.com/evcodesigningsha2-g1.crl071http://crl4.digicert.com/evcodesigningsha2-g1.crl0kd0b070*0(https://www.digicert.com/cps0r0p0$http://ocsp.digicert.com0h9iqmgvw,czc9ckx89_oarsm[;mn^" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=digicert" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://sf.symcb.com/sf.crl0az0x0v0l0" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0k0i0http://sf.symcd.com0&http://sf.symcb.com/sf.crt0[" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://crl3.digicert.com/assured-cs-g1.crl00*http://crl4.digicert.com/assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0v0t0$http://ocsp.digicert.com0l@http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0g]" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://crl4.digicert.com/evcodesigningsha2-g1.crl1.3.6.1.4.1.311.60.2.1.2http://crl3.digicert.com/evcodesigningsha2-g1.crl" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0j0h02,http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0brqtfdb^db@dba" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "https://www.digicert.com/cps0v0t0$http://ocsp.digicert.com0l@http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0g]" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0i=http://cacerts.digicert.com/digicerthighassuranceevrootca.crt0:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0.http://www.digicert.com/ssl-cps-repository.htm0:fk" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrz0x0:4http://crl4.digicert.com/disuredidrootca.crl0:4http://crl3.digicert.cortassuredidrootca.crl0pi0g080*w" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "https://www.digicert.com/cps08ambf$-t" - Source: "00000000-00007060.00000000.75739.02FD0000.00000004.mdmp") Found URL "http://crl3.digicert.com/evcodesigningsha2-g1.crl071http://crl4.digicert.com/evcodesigningsha2-g1.crl0kd0b070*0(https://www.digicert.com/cps0r0p0$http://ocsp.digicert.com0h.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGFLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "")57:T6c2,Dropped file: "782AC1F7D5B160B0F71F6F92B0912799" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\782AC1F7D5B160B0F71F6F92B0912799]- [targetUID: 00000000-00007060] Dropped file: "DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929]- [targetUID: 00000000-00007060] Dropped file: "8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D]- [targetUID: 00000000-00007060] Dropped file: "DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929]- [targetUID: 00000000-00007060] Dropped file: "8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D]- [targetUID: 00000000-00007060] Dropped file: "6E47DC54834F661FE77B461D2DF73D9D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6E47DC54834F661FE77B461D2DF73D9D]- [targetUID: 00000000-00007060] Dropped file: "782AC1F7D5B160B0F71F6F92B0912799" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\782AC1F7D5B160B0F71F6F92B0912799]- [targetUID: 00000000-00007060] Dropped file: "6E47DC54834F661FE77B461D2DF73D9D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6E47DC54834F661FE77B461D2DF73D9D]- [targetUID: 00000000-00007060]58:T496,"Set-up.bin" has resource with unusual entropy "GIF:7.80743643228" "Set-up.bin" has resource with unusual entropy "GIF:7.90998374034" "Set-up.bin" has resource with unusual entropy "PNG:7.90522229668" "Set-up.bin" has resource with unusual entropy "PNG:7.9466847663" "Set-up.bin" has resource with unusual entropy "PNG:7.49439760703" "Set-up.bin" has resource with unusual entropy "PNG:7.76210094964" "Set-up.bin" has resource with unusual entropy "PNG:7.00909714501" "Set-up.bin" has resource with unusual entropy "PNG:7.42558515596" "Set-up.bin" has resource with unusual entropy "PNG:7.32620094775" "Set-up.bin" has resource with unusual entropy "PNG:7.70354752082" "Set-up.bin" has resource with unusual entropy "PNG:7.49410096143" "Set-up.bin" has resource with unusual entropy "PNG:7.26638674753" "Set-up.bin" has resource with unusual entropy "PNG:7.85493430239" "Set-up.bin" has resource with unusual entropy "PNG:7.55792278068" "Set-up.bin" has resource with unusual entropy "PNG:7.71488111611" "Set-up.bin" has resource with unusual entropy "PNG:7.92856408015" "Set-up.bin" has resource with unusual entropy "RT_ICON:7.63007795017"59:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A////////////////////////////////////////////////////////////////+IiIiIiIiIiIiIiIiIiIj/iI////////////////iI/4j/////////////////iI+P//////////////////j/j//////////////////4/4////+P///4d4/4////+P+P////f///93f/9/////j/j////3j/h3d4/4f////4/4////93//d3f/93////+P+P////d//4d4//d/////j/j////3d//3f/93f////4/4////93f/93//d3////+P+P////d3j///+Hd/////j/j////3d3////d3f////4/4////93d4//+Hd3////+P+P////d3d///d3d/////j/j////3d3eP+Hd3f////4/4//////////////////+P+P//////////////////j/j//////////////////4/4//////////////////+P+IiIiIiIiIiIiIiIiIiIj/iI////////////////iI//iI//////////////+Ij///iI/////////////4iP////iIiIiIiIiIiIiIiI//////////////////////////////////////////////////////////////////////////////////+AAAABgAAAAYAAAACAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAcAAAAPgAAAH8AAAD////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":60,"unified_at_epoch_ms":1790484438323,"unified_at":"2026-09-27T04:47:18.323Z","metadata":{"hashes":{"sha256":"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91","sha1":"327b6c190b958fae0e42fbef67f45bde6dfe23df","md5":"ee696b1cfaff5f82541968cc5f9fd225","sha512":"f3cf093eec76aebbfde8a200a32513a624d0508d9c4ae813ec52d904bf18792146dd8afcb57c7a414c4da5fa7a20aeac0e6f446a4c6ac60bd01899df72a465ec","ssdeep":"98304:T6GIx+hQHFvdTjTF1TGqAnaiiljqQC/UVQy3:+GIgYTPF1TGq9E/UVD3","ssdeep_chunks":["98304:T6GIx+h","98304:6GIx+hQ","98304:GIx+hQH","98304:Ix+hQHF","98304:x+hQHFv","98304:+hQHFvd","98304:hQHFvdT","98304:QHFvdTj","98304:HFvdTjT","98304:FvdTjTF","98304:vdTjTF1","98304:dTjTF1T","98304:TjTF1TG","98304:jTF1TGq","98304:TF1TGqA","98304:F1TGqAn","98304:1TGqAna","98304:TGqAnai","98304:GqAnaii","98304:qAnaiil","98304:Anaiilj","98304:naiiljq","98304:aiiljqQ","98304:iiljqQC","98304:iljqQC/","98304:ljqQC/U","98304:jqQC/UV","98304:qQC/UVQ","98304:QC/UVQy","98304:C/UVQy3","196608:T6GIx+h","196608:6GIx+hQ","196608:GIx+hQH","196608:Ix+hQHF","196608:x+hQHFv","196608:+hQHFvd","196608:hQHFvdT","196608:QHFvdTj","196608:HFvdTjT","196608:FvdTjTF","196608:vdTjTF1","196608:dTjTF1T","196608:TjTF1TG","196608:jTF1TGq","196608:TF1TGqA","196608:F1TGqAn","196608:1TGqAna","196608:TGqAnai","196608:GqAnaii","196608:qAnaiil","196608:Anaiilj","196608:naiiljq","196608:aiiljqQ","196608:iiljqQC","196608:iljqQC/","196608:ljqQC/U","196608:jqQC/UV","196608:qQC/UVQ","196608:QC/UVQy","196608:C/UVQy3","98304:+GIgYTP","98304:GIgYTPF","98304:IgYTPF1","98304:gYTPF1T","98304:YTPF1TG","98304:TPF1TGq","98304:PF1TGq9","98304:F1TGq9E","98304:1TGq9E/","98304:TGq9E/U","98304:Gq9E/UV","98304:q9E/UVD","98304:9E/UVD3"],"imphash":"89b21794a33c48de65231b94590b7b88"},"file_info":{"file_name":"Set-up.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5481520,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1589736801000,"last_seen":1694364486000,"last_multi_scan":1694364486000}},"detections":{"summary":{"verdict":"suspicious","score":60,"tags":["evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":78},"sandbox_signatures":{"informative_count":173,"suspicious_count":17,"malicious_count":2,"total":192},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3467965","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/techniques/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"malicious","value":"Modifies System Certificates Settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/techniques/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"PE file contains large number of import functions"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"suspicious","value":"Found encryption key used by malware in binary"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"References to WMI query strings used to retrieve disk information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Set-up.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SET-UP.EXE\")\n \"Set-up.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SET-UP.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/73 Antivirus vendors marked sample as malicious (0% detection rate)\n 0/23 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"Set-up.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');\"\n \"INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);\"\n \"CREATE TABLE IF NOT EXISTS opm_data ( domain varchar(25), subDomain varchar(25), key varchar(100), value TEXT, PRIMARY KEY (domain, subDomain, key) );\"\n \"CREATE TABLE IF NOT EXISTS opm_data_v2 ( domain varchar(25), subDomain varchar(25), key varchar(100), value TEXT, PRIMARY KEY (domain, subDomain, key) );\"\n \"CREATE TABLE IF NOT EXISTS opm_user ( key varchar(25), value TEXT, PRIMARY KEY (key) );\"","origin":"File/Memory","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"Set-up.exe\" created file \"%TEMP%\\CreativeCloud\\ACC\\AdobeDownload\\HDInstaller.log\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\HDInstaller.log\"\n \"HDInstaller.log\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Set-up.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"Set-up.exe\" touched \"XML DOM Document 3.0\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{F5078F32-C551-11D3-89B9-0000F81FE221}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"Set-up.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert EV Code Signing CA SHA2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: E4:C0:3D:89:5E:15:90:FD:81:38:F4:55:F4:F3:66:BF:17:DE:D3:5D; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 60:EE:3F:C5:3D:4B:DF:D1:69:7A:E5:BE:AE:1C:AB:1C:0F:3A:D4:E3; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"Set-up.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D\" has type \"data\"\n \"DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929\" has type \"data\"\n \"HDInstaller.log\" has type \"Little-endian UTF-16 Unicode text with CRLF CR line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"Set-up.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"Set-up.exe\" touched file \"%WINDIR%\\SysWOW64\\tzres.dll\"\n \"Set-up.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"\n \"Set-up.exe\" touched file \"%WINDIR%\\SysWOW64\\msxml3r.dll\"\n \"Set-up.exe\" touched file \"%WINDIR%\\SysWOW64\\rsaenh.dll\"\n \"Set-up.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\winhttp.dll.mui\"\n \"Set-up.exe\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"Set-up.exe\" touched file \"%WINDIR%\\SysWOW64\\imageres.dll\"\n \"Set-up.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Set-up.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Set-up.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"Set-up.exe\" at 00171403-00003292-00000033-5538990814","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$28","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Win32_BaseBoard\" (Indicator: \"win32_baseboard\"; File: \"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91.bin\")\n \"Win32_BIOS\" (Indicator: \"win32_bios\"; File: \"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91.bin\")\n \"Win32_NetworkAdapter\" (Indicator: \"win32_networkadapter\"; File: \"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91.bin\")\n \"Win32_Processor\" (Indicator: \"win32_process\"; File: \"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91.bin\")\n \"SELECT * FROM Win32_DiskDrive where interfaceType != 'USB'\" (Indicator: \"win32_diskdrive\"; File: \"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91.bin\")\n \"SELECT * FROM Win32_DiskDrive where interfaceType = 'USB'\" (Indicator: \"win32_diskdrive\"; File: \"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Set-up.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Set-up.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"Set-up.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"Set-up.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$29","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.0.159\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"XROOT\\CIMV2\" (Indicator: \"root\\cimv2\")\n \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$2b","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"Set-up.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91.bin\" (Offset: 1482825)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\".exe\" called \"FindResourceW\" with parameter \"200\" - (UID: 00000000-00007060)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2d","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"$30","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"RandomNumberGenerator: IncorporateEntropy not implemented\" (Indicator: \"RandomNumberGenerator\"; File: \"Set-up.bin\")\n Found reference to \"RandomNumberGenerator: IncorporateEntropy not implemented\" (Indicator: \"RandomNumberGenerator\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007060.00000000.75739.02FD0000.00000004.mdmp\")\n Found reference to \"0Aes\" (Indicator: \"Aes\"; Source: \"00000000-00007060.00000000.75739.03270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007060.00000000.75739.003A0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\; Source: \"Set-up.bin\")\n Found string - \\\\.\\pipe\\; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Set-up.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Set-up.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"Set-up.bin\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"Set-up.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"Set-up.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007060.00000000.75739.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"& ( 2 9 < D ^ p t\" (Indicator: \" ^ \"; Source: \"00000000-00007060.00000000.75739.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$32","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$33","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts domains\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"7060\" - (UID: 00000000-00007060)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\".exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00007060)\n \".exe\" called \"GetWindowTextW\" with parameter \"The installation cannot continue as the installer file may be damaged. Download the installer file again.\" - (UID: 00000000-00007060)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007060)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"Set-up.bin\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$35","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"Set-up.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"Set-up.bin\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"Set-up.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Set-up.bin\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Set-up.bin\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"SET NULL\" (Indicator: \"set \"; File: \"Set-up.bin\")\n Found string \"SET DEFAULT\" (Indicator: \"set \"; File: \"Set-up.bin\")\n Found string \"set list\" (Indicator: \"set \"; File: \"Set-up.bin\")\n Found string \"set transaction in opd_deleteRecordWithFields with error as : %d\" (Indicator: \"set \"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found string \"set signature validation done\" (Indicator: \"set \"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found string \"set parameter is null.\" (Indicator: \"set \"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"Set-up.bin\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"Set-up.bin\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"Set-up.bin\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"Set-up.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"Set-up.bin\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"Set-up.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used to retrieve disk information","description":"Found string \"SELECT * FROM Win32_DiskDrive where interfaceType != 'USB'\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found string \"SELECT * FROM Win32_DiskDrive where interfaceType = 'USB'\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-514","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Microsoft Connection Test\" (SID: 2031071, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.digicert.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"SHCreateDirectoryEx failed. Error: %d\" (Indicator: \"CreateDirectory\"; File: \"Set-up.bin\")\n Found reference to API \"SHCreateDirectoryExW\" (Indicator: \"CreateDirectory\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SHCreateDirectoryEx failed. Error: %d\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SHCreateDirectoryExW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Set-up.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 1928704)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"Set-up.bin\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Set-up.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Set-up.bin\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: Microsoft-CryptoAPI/10.0\" (Indicator: \"user-agent: \"; Source: \"00000000-00007060.00000000.75739.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$42","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74590000\n \".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73080000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77A20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Set-up.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Set-up.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Set-up.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$44","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Set-up.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Set-up.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"KERNEL32.dll\" : \"222\" [Source: Set-up.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Set-up.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Set-up.bin\" file has an entrypoint instructions - \"call\t0x5a2518,jmp\t0x5a1889,int3\t,cmp\tdword ptr [0x686910], 6,jl\t0x5a1a20,vcvttss2usi\teax, xmm0,ret\t,movd\teax, xmm0,shl\teax, 1,jb\t0x5a1a43,cmp\teax, 0x9e000000,jae\t0x5a1a34,cvttss2si\teax, xmm0,ret\t,cmp\teax, 0x9f000000,jae\t0x5a1a4a,shl\teax, 7,bts\teax, 0x1f,ret\t,cmp\teax, 0x7f000000,jb\t0x5a1a2f,cvttss2si\tecx, dword ptr [0x611f80],cmc\t,sbb\teax, eax,ret\t,cmp\tdword ptr [0x686910], 6,jl\t0x5a1a79,mov\teax, 1,kmovb\tk1, eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x204a00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x29e600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x2049c6\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x29e4c8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ocsp.digicert.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\KERNEL32.dll\" [Source: 00000000-00007060-00000C25-38813094]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Set-up.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CreativeCloud\\ACC\\AdobeDownload\\HDInstaller.log\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Set-up.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Set-up.bin\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\".exe\" queries basic process information of the \"C:\\Set-up.exe\" (UID: 7060)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\".exe\" called \"NtQueueApcThread\" (UID: 00000000-00007060)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\".exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\creativecloud\\acc\\adobedownload\\hdinstaller.log\"\n \".exe\" reads file \"c:\\set-up.exe\"\n \".exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d\"\n \".exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"7261-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00007060.00000000.75739.02EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: The input sample contains a known anti-VM trick","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\".exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to touch file \"C:\\SET-UP.EXE.LOCAL\"\n \".exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\comctl32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\WindowsShell.Manifest\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"\n \".exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\creativecloud\\acc\\adobedownload\\hdinstaller.log\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\da3b6e45325d5fff28cf6bad6065c907_ea01b8ac2c0be6e5850a0487d704d929\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\da3b6e45325d5fff28cf6bad6065c907_ea01b8ac2c0be6e5850a0487d704d929\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\".exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CreativeCloud\\ACC\\AdobeDownload\\HDInstaller.log\"\n \".exe\" writes a file \"%TEMP%\\CreativeCloud\\ACC\\AdobeDownload\\HDInstaller.log\"\n \"Set-up.exe\" writes a file \"%TEMP%\\CreativeCloud\\ACC\\AdobeDownload\\HDInstaller.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D\"\n Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHvX7K0Gf17ibCk%3D\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /EVCodeSigningSHA2-g1.crl HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007060.00000000.75739.02FD0000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007060.00000000.75739.05C90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$4b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://sqe\"\n Found HTTPS url \"https://qe\"\n Found HTTPS url \"https://prod\"\n Found HTTPS url \"https://cdn\"\n Found HTTPS url \"https://oobe.adobe.com\"\n Found HTTPS url \"https://tron\"\n Found HTTPS url \"https://tronstageuserpackages.s3\"\n Found HTTPS url \"https://tronstageuserpackages.s3.amazonaws.com\"\n Found HTTPS url \"https://trondevuserpackages.s3\"\n Found HTTPS url \"https://trondevuserpackages.s3.amazonaws.com\"\n Found HTTPS url \"https://stage.adminconsole.adobe.com\"\n Found HTTPS url \"https://adminconsole.adobe.com\"\n Found HTTPS url \"https://qa.adminconsole.adobe.com\"\n Found HTTPS url \"https://www.adobe.com\"\n Found HTTPS url \"https://helpx.adobe.com\"\n Found HTTPS url \"https://accounts.adobe.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00007060\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"In ProcessUtils::GetActiveUserSessionID. Error in WTSEnumerateSessions %d\" (Indicator: \"WTSEnumerateSessions\"; File: \"Set-up.bin\")\n Found reference to API \"nID. Error in WTSEnumerateSessions %d\" (Indicator: \"WTSEnumerateSessions\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"In ProcessUtils::GetActiveUserSessionID. Error in WTSEnumerateSessions %d\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33621433\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1392577021\"\n \"cx\": \"75\"\n \"cy\": \"23\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"In ProcessUtils::GetActiveUserSessionID. Error in WTSEnumerateSessions %d\" (Indicator: \"WTSEnumerateSessions\"; File: \"Set-up.bin\")\n Found reference to API \"nID. Error in WTSEnumerateSessions %d\" (Indicator: \"WTSEnumerateSessions\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"In ProcessUtils::GetActiveUserSessionID. Error in WTSEnumerateSessions %d\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Set-up.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; File: \"Set-up.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Set-up.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"Set-up.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$52","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: Set-up.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_DiskDrive where interfaceType != 'USB'\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found string \"SELECT * FROM Win32_DiskDrive where interfaceType = 'USB'\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007060.00000000.75739.02FD0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007060.00000000.75739.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; File: \"Set-up.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"Set-up.bin\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"Set-up.bin\")\n Found reference to API \"RemoveDirectoryFailed:\" (Indicator: \"RemoveDirectory\"; File: \"Set-up.bin\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryFailed:\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"Set-up.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; File: \"Set-up.bin\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Set-up.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$55","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"Set-up.bin\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00007060.00000000.75739.005A6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$57","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"Set-up.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/71 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com0\"\n Pattern match: \"noreply@vmware.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"General","name":"Found encryption key used by malware in binary","description":"\"sample.bin\" contain encryption key b'\\xe7\\x00\\xe5\\x00' at (Offset: 2218894)","origin":"Binary File","mitre_attack_id":"T1027","relevance":10,"id":"binary-54","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$58","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\"; Key: \"E4A2E2000A9A21B45EA38BF3A71C10270C6737AB\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\E4A2E2000A9A21B45EA38BF3A71C10270C6737AB\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]}],"incidents":[{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies System Certificates Settings"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":81,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":36,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive"],"sample_flags":["Extracted Files","Network Traffic"],"sandbox_reports":[{"id":"64e4e16647b4e6db53034651","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","malware_family":"Trojan.Agent","contacted_countries":["USA"],"submit_name":"Set-up.exe","analysis_start_time":"2023-08-22T16:25:10+00:00","indicators_count":{"informative":171,"suspicious":27,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5ec17560c85da12e264eb650","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":60,"submit_name":"Set-up.exe","analysis_start_time":"2020-05-17T17:33:25+00:00","indicators_count":{"informative":18,"suspicious":14,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"ocsp.digicert.com","address":"192.229.211.108","ttl":21394,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"DigiCert, Inc.","registrar_name_servers":"NS1.P03.DYNECT.NET","registrar_creation_date":"1996-12-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]}],"http_requests":[{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHvX7K0Gf17ibCk%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHvX7K0Gf17ibCk%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}],"processes":[{"pid":3292,"ppid":0,"name":"Set-up.exe","command_line":"","sha256":"457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91","normalized_path":"C:\\Set-up.exe","uid":"00171403-00003292","icon":"$59"}],"all_imported_dlls":["rasadhlp.dll","shlwapi.dll","shell32.dll","imagehlp.dll","gpapi.dll","devobj.dll","cryptsp.dll","lpk.dll","winnsi.dll","wow64.dll","ole32.dll","msasn1.dll","msctf.dll","bcrypt.dll","cryptnet.dll","WSHTCPIP.DLL","dnsapi.dll","wow64cpu.dll","usp10.dll","clbcatq.dll","KernelBase.dll","msxml3.dll","msxml3r.dll","bcryptprimitives.dll","imageres.dll","setupapi.dll","cryptbase.dll","gdi32.dll","api-ms-win-core-synch-l1-2-0.dll","wintrust.dll","wow64win.dll","user32.dll","oleaut32.dll","wship6.dll","dwmapi.dll","sspicli.dll","uxtheme.dll","userenv.dll","ws2_32.dll","FWPUCLNT.DLL","rsaenh.dll","SensApi.dll","nsi.dll","kernel32.dll","webio.dll","dhcpcsvc6.dll","ntdll.dll","msvcrt.dll","Wldap32.dll","winhttp.dll","credssp.dll","comctl32.dll","mswsock.dll","IPHLPAPI.DLL","cfgmgr32.dll","rpcrt4.dll","advapi32.dll","imm32.dll","tzres.dll","ncrypt.dll","sechost.dll","crypt32.dll","profapi.dll","dhcpcsvc.dll","combase.dll","gdi32full.dll","OnDemandConnRouteHelper.dll","SHCore.dll","msvcp_win.dll","win32u.dll","fltLib.dll","VxSSL32.dll","CoreUIComponents.dll","CoreMessaging.dll","kernel.appcore.dll","powrprof.dll","WinTypes.dll","TextInputFramework.dll","windows.storage.dll","ntmarta.dll","ucrtbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D","sha256":"dc7bf28aa5d09a71d942a5ee91074b4ce28c3ca2d9a66f3f808f6ae615427378","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"name":"DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929","sha256":"281f87117ca00b9a9ad33b15e3e2b4998ee53b98363e77843f9a1d6323c49c62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"name":"HDInstaller.log","sha256":"df518f608bfd63e5987b2124771f4ecdf98bdf3e3d0b4455700645fde4448b41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"name":"6E47DC54834F661FE77B461D2DF73D9D","sha256":"be27f30799d1c34e02f51b03ddc205d91c9a0426677a37176b710db657b11e33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"name":"782AC1F7D5B160B0F71F6F92B0912799","sha256":"be27f30799d1c34e02f51b03ddc205d91c9a0426677a37176b710db657b11e33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]}],"files_written":[{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%TEMP%\\CreativeCloud","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%TEMP%\\CreativeCloud\\ACC","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%TEMP%\\CreativeCloud\\ACC\\AdobeDownload","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%TEMP%\\CreativeCloud\\ACC\\AdobeDownload\\HDInstaller.log","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%TEMP%\\CreativeCloud\\ACC\\AdobeDownload\\asu.trace","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"C:\\Set-up.exe","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8890A77645B73478F5B1DED18ACBF795_3F584A3392BB586FC541F0F81FC9D443","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\2659C1A560AB92C9C29D4B2B25815AE8","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0270780F846F08BEFE0DD8112D932FEF","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\DA3B6E45325D5FFF28CF6BAD6065C907_4C35F1EE5966309704301FF08936B40A","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\782AC1F7D5B160B0F71F6F92B0912799","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6E47DC54834F661FE77B461D2DF73D9D","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%TEMP%\\{56E33186-40C8-40E8-8E47-00A0931F8D67}","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"path":"%TEMP%\\CREATIVECLOUD\\ACC\\ADOBEDOWNLOAD","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\782AC1F7D5B160B0F71F6F92B0912799","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6E47DC54834F661FE77B461D2DF73D9D","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\FEATURECONTROL\\FEATURE_BROWSER_EMULATION\\","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\FEATURECONTROL\\FEATURE_BROWSER_EMULATION\\","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\HDInstaller.log","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"}]},{"name":"HDInstaller.log","sources":[{"report_type":"sandbox","report_id":"5ec17560c85da12e264eb650"},{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"name":"SM0:7060:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]},{"name":"Local\\SM0:7060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64e4e16647b4e6db53034651"}]}]}},"report_ids":{"sandbox_job_ids":["5ec17560c85da12e264eb650","64e4e16647b4e6db53034651"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Trojan.Agent Sample 457f73f71547… — Score 60/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 457f73f71547…. Malware family: Trojan.Agent. Threat score 60/100. 1/28 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91"}],["$","meta","4",{"property":"og:title","content":"Suspicious Trojan.Agent Sample 457f73f71547… — Score 60/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 457f73f71547…. Malware family: Trojan.Agent. Threat score 60/100. 1/28 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/457f73f71547d5589a926a138acd8cb23ac1c5f9dfbd741c8f4a36a0404eff91"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Trojan.Agent Sample 457f73f71547… — Score 60/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 457f73f71547…. Malware family: Trojan.Agent. Threat score 60/100. 1/28 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5a","11",{}]]