24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ursu.Generic Sample 48f630d779a4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 48f630d779a4…. Malware family: Ursu.Generic. Threat score 100/100. 15/23 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/48f630d779a4eb62bda8089063a2445c0421c74bd6351d7942ec90396a7faaa9","keywords":["Malicious","Ursu.Generic","malware analysis","sandbox report","threat intelligence","48f630d779a4eb62bda8089063a2445c0421c74bd6351d7942ec90396a7faaa9"],"about":{"@type":"SoftwareApplication","name":"Text_Utils_byGuron_v1.3_obf.exe","applicationCategory":["peexe","executable"],"identifier":"48f630d779a4eb62bda8089063a2445c0421c74bd6351d7942ec90396a7faaa9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ursu.Generic","antivirusDetections":{"malicious":15,"total":23},"behavioralIndicators":{"malicious":9,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T993,Attempt to find devices in networks: "169.254.0.129/32, 169.254.2.243/32, 169.254.6.0/32, 169.254.7.70/32, 169.254.14.46/32, 169.254.18.206/32, 169.254.40.52/32, 169.254.41.117/32, 169.254.42.87/32, 169.254.51.70/32, 169.254.60.26/32, 169.254.60.158/32, 169.254.61.38/32, 169.254.64.14/32, 169.254.74.27/32, 169.254.74.95/32, 169.254.76.110/32, 169.254.77.127/32, 169.254.85.84/32, 169.254.100.38/32, 169.254.105.6/32, 169.254.105.108/32, 169.254.108.139/32, 169.254.110.71/32, 169.254.122.26/32, 169.254.128.3/32, 169.254.137.44/32, 169.254.143.187/32, 169.254.147.240/32, 169.254.160.106/32, 169.254.162.51/32, 169.254.163.129/32, 169.254.173.27/32, 169.254.178.40/32, 169.254.182.20/32, 169.254.188.145/32, 169.254.202.115/32, 169.254.209.92/32, 169.254.211.150/32, 169.254.230.63/32, 169.254.239.78/32, 169.254.243.73/32, 169.254.247.222/32, 169.254.248.43/32, 169.254.255.16/32, 192.168.240.1/32, 192.168.240.2/32, 192.168.240.18/32, 192.168.240.128/32, 192.168.240.133/32, 192.168.240.141/32, 192.168.240.142/32, 192.168.240.200/32, 192.168.240.210/32, 192.168.241.47/32, 192.168.241.59/32, 192.168.241.60/32, 192.168.241.66/31, 192.168.241.83/32, 192.168.241.87/32, 192.168.241.91/32, 192.168.241.98/32, 192.168.241.111/32, 192.168.241.116/31, 192.168.241.119/32, 192.168.241.146/32, 192.168.241.156/32, 192.168.241.166/32, 192.168.241.197/32, 192.168.241.222/32, 192.168.241.230/32, 192.168.241.234/32, 192.168.241.236/32, 192.168.241.245/32, 192.168.241.250/32, 192.168.242.4/32, 192.168.242.21/32, 192.168.242.26/32, 192.168.242.33/32, 192.168.242.41/32, 192.168.242.49/32, 192.168.242.71/32, 192.168.242.88/32, 192.168.242.102/32, 192.168.242.109/32, 192.168.242.125/32, 192.168.242.131/32, 192.168.242.143/32, 192.168.242.146/32, 192.168.242.166/32, 192.168.242.168/32, 192.168.242.171/32, 192.168.242.191/32, 192.168.242.192/32, 192.168.242.196/32, 192.168.242.200/31, 192.168.242.204/32, 192.168.242.211/32, 192.168.242.215/32, 192.168.242.218/32, 192.168.242.224/32, 192.168.242.228/32, 192.168.242.240/32, 192.168.243.0/32, 192.168.243.2/32, 192.168.243.22/32, 192.168.243.29/32, 192.168.243.42/32, 192.168.243.60/32, 192.168.243.74/32, 192.168.243.77/32, 192.168.243.100/32, 192.168.243.111/32, 192.168.243.116/32, 192.168.243.128/32, 192.168.243.130/32, 192.168.243.140/32, 192.168.243.152/32, 192.168.243.155/32, 192.168.243.178/32, 192.168.243.208/32, 192.168.243.222/32, 192.168.243.224/32, 192.168.243.237/32, 192.168.243.239/32"26:T4a9,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp")27:T9fe,"TextUtilsbyGuron.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000a808ed30a383c87168fe6e00687dab7710ee6f0040b1c871f49a4841feffffff2ced6f000272c771d0ec6f000000ca75c8ed6f001b72c771e0dfe57608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000058ed6f00000000000800000000000000000000000000000000000000000000000000ca75c008ed300000000098ed6f0069922d76ffffffff3400000058ed6f0008000000000000000000ca75c8ed6f0027942d7660ed6f000b00000000000000b0ed6f00 (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c9d74f4ec6f00226e147700000405000000002d6e1477b2da712a2d000000ecb7937478ed6f00b1ce9800f8877800b0ad77001d00000080000000b8ec6f0000003d003ced6f0070c81577be47045dfeffffff2d000000d0cca274270000000ced6f00856a16771c231b774ced6f00f85f167708000000bb691577b26915770adb712a2d000000ecb7937427000000d0cca27420ed6f002d000000d0cca2742700000050ed6f00856a16771c231b7798ed6f007e8aa174ee8ca174738aa17498f59b022d000000ecb7937427000000d0cca2749c1204053012040598f59b0260ed6f00fc52df744cee6f00e084a17438e92976feffffff738aa174 (UID: 00000000-00004896)28:T469,"TextUtilsbyGuron.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "LoadLibrary" with a parameter shlwapi (UID: 00000000-00004896)29:T2a17,"TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter PathAddExtensionA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter PathCombineA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter StrChrA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter StrToIntA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter RtlFreeHeap (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetModuleHandleExA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter LockFile (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter LockFileEx (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CopyFileExA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetFileAttributesExA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter OpenFileMappingA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter OpenFileMappingW (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter MapViewOfFileEx (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004896) "TextUtilsbyGuron.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004896)2a:T1d75,Found reference to API (Indicator: "lstrcpy"; File: "Text Utils byGuron.exe") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExA"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExA"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "CopyFileExA"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "OpenFileMappingA"; Source: "00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFileEx"; Source: "00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API (Indicator: "CryptVerifySignatureA"; Source: "00000000-00004896.00000002.115866.00770000.00000004.mdmp")2b:T523,"TextUtilsbyGuron.exe" loaded module "KERNEL32" at base 76100000 "TextUtilsbyGuron.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 761d0000 "TextUtilsbyGuron.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 761d0000 "TextUtilsbyGuron.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 761d0000 "TextUtilsbyGuron.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 771d0000 "TextUtilsbyGuron.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761d0000 "TextUtilsbyGuron.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761d0000 "TextUtilsbyGuron.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761d0000 "TextUtilsbyGuron.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 732b0000 "TextUtilsbyGuron.exe" loaded module "USER32.DLL" at base 774f0000 "TextUtilsbyGuron.exe" loaded module "ADVAPI32.DLL" at base 76ff0000 "TextUtilsbyGuron.exe" loaded module "NTDLL.DLL" at base 77c10000 "TextUtilsbyGuron.exe" loaded module "WINMM.DLL" at base 731e0000 "TextUtilsbyGuron.exe" loaded module "NTDLL" at base 77c10000 "TextUtilsbyGuron.exe" loaded module "SHELL32.DLL" at base 74910000 "TextUtilsbyGuron.exe" loaded module "KERNEL32.DLL" at base 76100000 "TextUtilsbyGuron.exe" loaded module "SHLWAPI" at base 776d00002c:T486,"Text Utils byGuron.exe" file has an entrypoint instructions - "jmp 0xbe200a,unpcklps xmm6, xmmword ptr [esi],add byte ptr [eax], al,add byte ptr [eax], al,add cl, ch,add byte ptr [eax], ah,add byte ptr [eax], al,add byte ptr [edx + ecx], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,adc byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,pop es,or al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [edx + ecx], al,add byte ptr [eax], al,pop es,or al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2d:T40f,"TextUtilsbyGuron.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "TextUtilsbyGuron.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "TextUtilsbyGuron.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "TextUtilsbyGuron.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "TextUtilsbyGuron.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "TextUtilsbyGuron.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "TextUtilsbyGuron.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "TextUtilsbyGuron.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")2e:T889,"TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "TextUtilsbyGuron.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2f:T8f3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp")30:T58f,Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp")31:T1de7,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\msrpc.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\msrpc.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ksecdd.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ksecdd.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\werkernel.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\werkernel.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\CLFS.SYS" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\CLFS.SYS" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\tm.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\tm.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\FLTMGR.SYS" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\FLTMGR.SYS" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\clipsp.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\clipsp.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\cmimcext.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\cmimcext.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ntosext.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ntosext.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\cng.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\cng.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\Wdf01000.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\Wdf01000.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WDFLDR.SYS" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WDFLDR.SYS" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WppRecorder.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WppRecorder.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\SleepStudyHelper.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\SleepStudyHelper.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\acpiex.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\acpiex.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\mssecflt.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\mssecflt.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ACPI.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ACPI.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\WMILIB.SYS" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\WMILIB.SYS" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\intelpep.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\intelpep.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WindowsTrustedRT.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WindowsTrustedRT.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\pcw.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\pcw.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\msisadrv.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\msisadrv.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\isapnp.sys" (Indicator: "\drivers\"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\isapnp.sys" (Indicator: "system32\drivers"; Source: "00000000-00004896.00000002.115866.00BE0000.00000004.mdmp")32:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"48f630d779a4eb62bda8089063a2445c0421c74bd6351d7942ec90396a7faaa9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790285766810,"unified_at":"2026-09-24T21:36:06.810Z","metadata":{"hashes":{"sha256":"48f630d779a4eb62bda8089063a2445c0421c74bd6351d7942ec90396a7faaa9","sha1":"ff19c0a797d76f2e96e4f072ebde71c8d1fd2618","md5":"8a65adc935bd3b7857535c948d7e5924","sha512":"d1f21e8a87bd51e530c8f7f7e9df2c7a5b4e65916b9cdea63c2d5989d11f1722cf0b9ffdeebd2728aa1220615c3f392db5d5b6c755b281ef31005371acd24e08","ssdeep":"98304:mL59VRKrVQs4zBd0aVwJ7aA5xu5xi9eYYD:S59KOs4v0a67nQg","ssdeep_chunks":["98304:mL59VRK","98304:L59VRKr","98304:59VRKrV","98304:9VRKrVQ","98304:VRKrVQs","98304:RKrVQs4","98304:KrVQs4z","98304:rVQs4zB","98304:VQs4zBd","98304:Qs4zBd0","98304:s4zBd0a","98304:4zBd0aV","98304:zBd0aVw","98304:Bd0aVwJ","98304:d0aVwJ7","98304:0aVwJ7a","98304:aVwJ7aA","98304:VwJ7aA5","98304:wJ7aA5x","98304:J7aA5xu","98304:7aA5xu5","98304:aA5xu5x","98304:A5xu5xi","98304:5xu5xi9","98304:xu5xi9e","98304:u5xi9eY","98304:5xi9eYY","98304:xi9eYYD","196608:mL59VRK","196608:L59VRKr","196608:59VRKrV","196608:9VRKrVQ","196608:VRKrVQs","196608:RKrVQs4","196608:KrVQs4z","196608:rVQs4zB","196608:VQs4zBd","196608:Qs4zBd0","196608:s4zBd0a","196608:4zBd0aV","196608:zBd0aVw","196608:Bd0aVwJ","196608:d0aVwJ7","196608:0aVwJ7a","196608:aVwJ7aA","196608:VwJ7aA5","196608:wJ7aA5x","196608:J7aA5xu","196608:7aA5xu5","196608:aA5xu5x","196608:A5xu5xi","196608:5xu5xi9","196608:xu5xi9e","196608:u5xi9eY","196608:5xi9eYY","196608:xi9eYYD","98304:S59KOs4","98304:59KOs4v","98304:9KOs4v0","98304:KOs4v0a","98304:Os4v0a6","98304:s4v0a67","98304:4v0a67n","98304:v0a67nQ","98304:0a67nQg"],"imphash":"2eabe9054cad5152567f0699947a2c5b"},"file_info":{"file_name":"Text_Utils_byGuron_v1.3_obf.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3552768,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286971000,"last_seen":1736171181000,"last_multi_scan":1736171181000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["neshta","banker","delf","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":38},"sandbox_signatures":{"informative_count":69,"suspicious_count":17,"malicious_count":9,"total":95},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.BTSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1372514","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ursu.494591","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_MSIL_Cryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ursu.494591 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.HEK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004b897a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.epfcgk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.LZYM-9203","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.MSIL.Convagent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ursu.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"malicious","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/techniques/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","identifiers":[{"type":"suspicious","value":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"_ldap._tcp.dc._msdcs.scl3.dc\"\n \"isatap.scl3.dc\"\n \"wpad.scl3.dc\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"},{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Text_Utils_byGuron_v1.3_obf.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"},{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"???\n hjpuzrch with unusual entropies 7.95727046289\n 7.94008357791","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"},{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"_ldap._tcp.dc._msdcs.scl3.dc\" seems to be random\n \"wpad.scl3.dc\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"169.254.74.95/32, 169.254.108.139/32, 192.168.240.2/32, 192.168.241.87/32, 192.168.241.230/32, 192.168.242.125/32, 192.168.242.166/32, 192.168.242.240/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"Text_Utils_byGuron_v1.3_obf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"},{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"48f630d779a4eb62bda8089063a2445c0421c74bd6351d7942ec90396a7faaa9.bin\" claimed CRC 3555288 while the actual is CRC 3580941","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"},{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"48f630d779a4eb62bda8089063a2445c0421c74bd6351d7942ec90396a7faaa9.bin\" has an entrypoint in section \".taggant\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"},{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"Text_Utils_byGuron_v1.3_obf.exe\" wrote bytes \"711116017a3b1501ab8b02007f950200fc8c0200729602006cc805001ecd12017d261201\" to virtual address \"0x75ED07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"},{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"VMware trick\" in \"48f630d779a4eb62bda8089063a2445c0421c74bd6351d7942ec90396a7faaa9.bin\" (Offset: 2637899)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"},{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/67 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"42/67 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"},{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"level":"malicious","category":"Network Related","name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"$25","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":10,"id":"network-31","sources":[{"report_type":"sandbox","report_id":"5f7821645dcc5f23e3027482"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 00016663-00002432-0000010C-39939608","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"WindowsFormsApp1.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A770000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 69C10000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"OLLYDBG\"\n \"\" searching for class \"GBDYLLO\"\n \"\" searching for class \"pediy06\"\n \"\" searching for class \"Filemonclass\"\n \"\" searching for class \"PROCMON_WINDOW_CLASS\"\n \"\" searching for class \"18467-41\"\n \"\" searching for class \"Regmonclass\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"l62jxK1N99@l62jxK.com\"\n Pattern match: \"www.sysinternals.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00016663-00002432-00000105-39388268","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"},{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"8/61 Antivirus vendors marked spawned process \"\" (PID: 2432) as malicious (classified as \"HW32.Packed\" with 13% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"}]},{"level":"malicious","category":"Installation/Persistance","name":"Creates a system file in windows directory","description":"\"\" created file \"%WINDIR%\\system32\\ntdll.dll\"","origin":"API Call","relevance":7,"id":"api-5","sources":[{"report_type":"sandbox","report_id":"590c5acfaac2edd22b4f1a21"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"Text_Utils_byGuron_v1.3_obf.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")\n \"Text_Utils_byGuron_v1.3_obf.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"629a2436a94d0f069e14ffe5"},{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.937320981688479","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00004896.00000002.115866.00BE0000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00004896.00000002.115866.00BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004896-00000C29-716344147\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"\\SystemRoot\\System32\\drivers\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00004896.00000002.115866.00BE0000.00000004.mdmp\")\n Found string \"\\SystemRoot\\System32\\drivers\\vmmouse.sys\" (Indicator: \"vmmouse\"; Source: \"00000000-00004896.00000002.115866.00BE0000.00000004.mdmp\")\n Found string \"\\SystemRoot\\System32\\drivers\\vmusbmouse.sys\" (Indicator: \"vmusb\"; Source: \"00000000-00004896.00000002.115866.00BE0000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmemctl.sys\" (Indicator: \"vmmemctl\"; Source: \"00000000-00004896.00000002.115866.00BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"\\SystemRoot\\System32\\drivers\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00004896.00000002.115866.00BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"TextUtilsbyGuron.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004896)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"TextUtilsbyGuron.exe\" called \"GetWindowTextA\" (UID: 00000000-00004896)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"TextUtilsbyGuron.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004896)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"TextUtilsbyGuron.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004896)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"TextUtilsbyGuron.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"105610218640,4156,3024,,RtlGetVersion,NTDLL.dll,\"00:29:49.421\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"TextUtilsbyGuron.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77390000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"TextUtilsbyGuron.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 765A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Text Utils byGuron.exe\" has an executable section named \"\"\n \"Text Utils byGuron.exe\" has an executable section named \"hjpuzrch\"\n \"Text Utils byGuron.exe\" has an executable section named \"zqdrcmrs\"\n \"Text Utils byGuron.exe\" has an executable section named \".taggant\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Text Utils byGuron.exe\" has an writable section named \"\"\n \"Text Utils byGuron.exe\" has an writable section named \".rsrc\"\n \"Text Utils byGuron.exe\" has an writable section named \".idata\"\n \"Text Utils byGuron.exe\" has an writable section named \"hjpuzrch\"\n \"Text Utils byGuron.exe\" has an writable section named \"zqdrcmrs\"\n \"Text Utils byGuron.exe\" has an writable section named \".taggant\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"hjpuzrch\" is \"0x334600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x45e000\" greater than 0x100000\n Virtual size of \"hjpuzrch\" is \"0x336000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Text Utils byGuron.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004896.00000000.112025.00770000.00000004.mdmp, 00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"TextUtilsbyGuron.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"TextUtilsbyGuron.exe\" queries basic process information of the \"C:\\TextUtilsbyGuron.exe\" (UID: 4896)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"TextUtilsbyGuron.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Able to identify virtual/sandbox environment\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Able to identify virtual/sandbox environment devices\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: The input sample contains a known anti-VM trick","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"TextUtilsbyGuron.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"TextUtilsbyGuron.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"TextUtilsbyGuron.exe\" trying to touch file \"C:\\TextUtilsbyGuron.exe\"\n \"TextUtilsbyGuron.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"TextUtilsbyGuron.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"TextUtilsbyGuron.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"TextUtilsbyGuron.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"TextUtilsbyGuron.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"TextUtilsbyGuron.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"TextUtilsbyGuron.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"TextUtilsbyGuron.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"\n \"TextUtilsbyGuron.exe\" trying to access non-existent file \"C:\\WINMM.DLL\"\n \"TextUtilsbyGuron.exe\" trying to access non-existent file \"C:\\winmm.dll\"\n \"TextUtilsbyGuron.exe\" trying to access non-existent file \"C:\\WINMMBASE.DLL\"\n \"TextUtilsbyGuron.exe\" trying to access non-existent file \"C:\\WINMMBASE.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"TextUtilsbyGuron.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"TextUtilsbyGuron.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"TextUtilsbyGuron.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"105610218640,4156,3024,,RtlGetVersion,NTDLL.dll,\"00:29:49.421\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004896.00000001.113947.00770000.00000004.mdmp, 00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"TextUtilsbyGuron.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$31","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"csrss.exe,winlogon.exe,services.exe,lsass.exe,svchost.exe\" (Source: \"00000000-00004896.00000002.115866.00BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"TextUtilsbyGuron.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"Text Utils byGuron.exe\" has section name with entropy \"7.95727046289\"\n \"Text Utils byGuron.exe\" has section name hjpuzrch with entropy \"7.94008357791\"\n \"Text Utils byGuron.exe\" has section name zqdrcmrs with entropy \"6.22105828432\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptVerifySignatureA\" (Indicator: \"CryptVerifySignatureA\"; Source: \"00000000-00004896.00000002.115866.00770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"TextUtilsbyGuron.exe\" (Thread ID: 5052) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"675c082f14c9b6e5e9016739"},{"report_type":"sandbox","report_id":"677bdead188d4ea4a0008bac"}]},{"level":"suspicious","category":"Network Related","name":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)","description":"Found more than 2 POST requests like this POST /RST2.srf HTTP/1.0Connection: Keep-Alive\n Content-Type: application/soap+xml\n Accept: */*\n User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 16.10.0.16299.0.0; IDCRL-cfg 16.0.28985.0; App svchost.exe, 10.0.16299.15, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})\n Content-Length: 4694\n Host: login.live.com\n with payload ==>