34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 39:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T41d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 47ee055bb304… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 47ee055bb304…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02","keywords":["malware analysis","sandbox report","threat intelligence","47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02"],"about":{"@type":"SoftwareApplication","name":"47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02","applicationCategory":["peexe","64bits","executable"],"identifier":"47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":0,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T1137,Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(158): WmiObject::invoke" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(158): WmiObject::invoke" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(158): WmiObject::invoke" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(201): failed to get WMI output parameters for %s::%s, sc=0x%08X" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(158): WmiObject::invoke" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(158): WmiObject::invoke" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(158): WmiObject::invoke" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(158): WmiObject::invoke" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(158): WmiObject::invoke" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(158): WmiObject::invoke" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(107): WmiObject::create" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(158): WmiObject::invoke" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(149): failed to create implementation of %s - '%s' (0x%08X)" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_41\drivers\nvwmi\WmiObject.h(158): WmiObject::invoke" (Indicator: "\drivers\"; Source: "sample.bin")37:T417,Found reference to API "C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(1362): ChangeServiceConfig2 failed to setup triggers, error=%d, %s" (Indicator: "ChangeServiceConfig"; Source: "sample.bin"), Found reference to API "ChangeServiceConfig2 failed to setup description, error=%d, %s" (Indicator: "ChangeServiceConfig"; Source: "sample.bin"), Found reference to API "ChangeServiceConfig2 failed to setup triggers, error=%d, %s" (Indicator: "ChangeServiceConfig"; Source: "sample.bin"), Found reference to API "C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(1352): ChangeServiceConfig2 failed to setup description, error=%d, %s" (Indicator: "ChangeServiceConfig"; Source: "sample.bin"), Found reference to API "ChangeServiceConfig failed - %s (%d)" (Indicator: "ChangeServiceConfig"; Source: "sample.bin"), Found reference to API "C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(1189): ChangeServiceConfig failed - %s (%d)" (Indicator: "ChangeServiceConfig"; Source: "sample.bin")38:T956,Found string "Set the amount of delay the frame lock card should wait, until generating sync pulse. Sync device must be in Server mode." (Indicator: "set "; Source: "sample.bin"), Found string "Set the maximum size, in megabytes, of the shader disk cache before it starts to delete old files. This replaces the previous TOC/BIN_SIZE keys." (Indicator: "set "; Source: "sample.bin"), Found string "Set the binary value by a setting ID" (Indicator: "set "; Source: "sample.bin"), Found string "Set number of pulses to wait between framelock signal generation." (Indicator: "set "; Source: "sample.bin"), Found string "Set the amount of delay between the frame sync signal and the GPUs signal. Sync device must be in Client mode or if external Housesync signal present." (Indicator: "set "; Source: "sample.bin"), Found string "Set the string value by a setting ID" (Indicator: "set "; Source: "sample.bin"), Found string "Set the post-heuristics preference for GDI compatibility in the control panel." (Indicator: "set "; Source: "sample.bin"), Found string "Set synchronization signal polarity" (Indicator: "set "; Source: "sample.bin"), Found string "Set video mode type" (Indicator: "set "; Source: "sample.bin"), Found string "Set interlace mode for a Sync device" (Indicator: "set "; Source: "sample.bin"), Found string "Set current profile" (Indicator: "set "; Source: "sample.bin"), Found string "Set mode of vertical synchronization in the current global profile" (Indicator: "set "; Source: "sample.bin"), Found string "Set desktop positions of all active display grids. All active display grids have to be re-positioned together. Primary grid (with taskbar) must be positioned at (0,0)" (Indicator: "set "; Source: "sample.bin"), Found string "Set nView Desktop Manager State" (Indicator: "set "; Source: "sample.bin"), Found string "Set a preference for or against choosing the DxPresent path in OpenGL and Vulkan. Affects OpenGL and Vulkan applications. This setting is applied after any enforcing options and driver heuristics." (Indicator: "set "; Source: "sample.bin"), Found string "Set the 32-bit value by a setting ID" (Indicator: "set "; Source: "sample.bin"), Found string "Set dithering parameters" (Indicator: "set "; Source: "sample.bin"), Found string "Set the maximum number of presents that can be queued before CPU blocks." (Indicator: "set "; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794378461435,"unified_at":"2026-11-11T06:27:41.435Z","metadata":{"hashes":{"sha256":"47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02","sha1":"62783baed551a3bbebd51f5db1999cc46ea7bd89","md5":"2a9ee3bd96a34fe57508a7c0714ce588","imphash":"57e60dcaa9cd645944fb3a5cf088da72","pehash":"5c3d6c634bbe744b41c5d6b71b26772b6658bc31"},"file_info":{"file_name":"47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":4512776,"entropy":6.32,"compile_timestamp":"2023-09-12T19:42:11","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794378428000,"last_seen":1794378428000,"last_multi_scan":1794378428000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":2937388,"raw_size":2937856},{"name":".rdata","virtual_address":"0x2cf000","virtual_size":1081176,"raw_size":1081344},{"name":".data","virtual_address":"0x3d7000","virtual_size":104028,"raw_size":54272},{"name":".pdata","virtual_address":"0x3f1000","virtual_size":220380,"raw_size":220672},{"name":"_RDATA","virtual_address":"0x427000","virtual_size":148,"raw_size":512},{"name":".rsrc","virtual_address":"0x428000","virtual_size":184024,"raw_size":184320},{"name":".reloc","virtual_address":"0x455000","virtual_size":13068,"raw_size":13312}],"section_names":[".text",".rdata",".data",".pdata","_RDATA",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":16},"sandbox_signatures":{"informative_count":18,"suspicious_count":4,"malicious_count":0,"total":22},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$36","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(843): CreateProcessAsUser failed\" (Indicator: \"CreateProcessAsUser\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessAsUser failed\" (Indicator: \"CreateProcessAsUser\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.002","id":"string-168","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetTokenInformation failed\" (Indicator: \"SetTokenInformation\"; Source: \"sample.bin\"), Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(826): SetTokenInformation failed\" (Indicator: \"SetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"taskmgr.exe\" (Indicator: \"taskmgr.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-45","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$37","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-192","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"failed to connect to OpenService, ec=%d, %s\" (Indicator: \"OpenService\"; Source: \"sample.bin\"), Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(1166): failed to connect to OpenService, ec=%d, %s\" (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken failed\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\"), Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(816): OpenProcessToken failed\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\nvfl0","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-146","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Tools.cpp(458): OpenProcess failed for pid=%d\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess failed for pid=%d\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Khronos\\Vulkan\\Drivers\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Wbem\\CIMOM\" in Source: sample.bin, \"SYSTEM\\CurrentControlSet\\Control\\Class\\\" in Source: sample.bin, \"SOFTWARE\\Khronos\\OpenCL\\Vendors\" in Source: sample.bin, \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" in Source: sample.bin, \"SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\NVWMI\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\_V2Providers\\{33d68436-4cf9-4f58-9976-44b048b072f3}\" in Source: sample.bin, \"SOFTWARE\\NVIDIA Corporation\\NVWMI\" in Source: sample.bin, \"Software\\NVIDIA Corporation\\Global\\nView\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(843): CreateProcessAsUser failed\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessAsUser failed\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$38","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Tools.cpp(166): GetUserObjectInformation failed, code=%d\" in \"sample.bin\", Found system information discovery API: \"GetUserObjectInformation failed, code=%d\" in \"sample.bin\", Found system information discovery API: \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Tools.cpp(196): GetUserObjectInformation failed, code=%d\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId: failed - %s, ec=%d\" (Indicator: \"ProcessIdToSessionId\"; Source: \"sample.bin\"), Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Tools.cpp(396): ProcessIdToSessionId: failed - %s, ec=%d\" (Indicator: \"ProcessIdToSessionId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-906","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"failed to connect to OpenService, ec=%d, %s\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"failed to connect to SCM, ec=%d, %s\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(1157): failed to connect to SCM, ec=%d, %s\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(1166): failed to connect to OpenService, ec=%d, %s\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(1234): failed to connect to SCM, ec=%d, %s\" (Indicator: \" connect \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Tools.cpp(166): GetUserObjectInformation failed, code=%d\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"GetUserObjectInformation failed, code=%d\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Tools.cpp(196): GetUserObjectInformation failed, code=%d\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Tools.cpp(469): EnumProcessModules failed for pid=%d\" (Indicator: \"EnumProcessModules\"; Source: \"sample.bin\"), Found reference to API \"EnumProcessModules failed for pid=%d\" (Indicator: \"EnumProcessModules\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"file/memory contains long string with (Indicator: \"cmd=\"; Source: \"sample.bin\"), Found string \"creating proccess on desktop %s , session=%d cmd=%s\" (Indicator: \"cmd=\"; Source: \"sample.bin\"), Found string \"created proccess pid=%d, parent pid=%d on desktop %s , session=%d cmd=%s\" (Indicator: \"cmd=\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-29","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"root\\cimv2\\NV\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\"), Found string \"root\\cimv2\\NV\\Events\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\"), Found string \"\\\\localhost\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService failed, error=%d\" (Indicator: \"CreateService\"; Source: \"sample.bin\"), Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(1341): CreateService failed, error=%d\" (Indicator: \"CreateService\"; Source: \"sample.bin\"), Found reference to API \"RegisterServiceCtrlHandlerEx failed: %d (0x%X)\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"sample.bin\"), Found reference to API \"C:/dvs/p4/build/sw/rel/gpu_drv/r535/r537_41/drivers/nvwmi/Service.cpp(324): RegisterServiceCtrlHandlerEx failed: %d (0x%X)\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-199","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" (Indicator: \"software\\microsoft\\windows nt\\currentversion\\winlogon\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02":{"type":"File","value":"47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:773f8068939db917040f6a371695905965d9663b5e79c198efea78f53f0ccc77":{"type":"File","value":"773f8068939db917040f6a371695905965d9663b5e79c198efea78f53f0ccc77","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"}},"chains":[{"id":"1569961675058711530","root":"File:47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"1569961733261177285","root":"File:47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02","to_key":"File:773f8068939db917040f6a371695905965d9663b5e79c198efea78f53f0ccc77"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02","edges":[{"edge_kind":"extracted","from_key":"File:47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02","to_key":"File:773f8068939db917040f6a371695905965d9663b5e79c198efea78f53f0ccc77"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"773f8068939db917040f6a371695905965d9663b5e79c198efea78f53f0ccc77","sha256":"773f8068939db917040f6a371695905965d9663b5e79c198efea78f53f0ccc77","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample 47ee055bb304… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 47ee055bb304…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02"}],["$","meta","4",{"property":"og:title","content":"Sample 47ee055bb304… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 47ee055bb304…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/47ee055bb3047fb647d5036a35f4dde591acbc78ade562a3ec81a0f6599ccf02"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 47ee055bb304… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 47ee055bb304…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]] 32:null