24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.NukeSped Sample 4c2efe2f1253… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4c2efe2f1253…. Malware family: Trojan.NukeSped. Threat score 100/100. 23/25 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","keywords":["Malicious","Trojan.NukeSped","malware analysis","sandbox report","threat intelligence","4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c"],"about":{"@type":"SoftwareApplication","name":"signed.exe","applicationCategory":["peexe","executable"],"identifier":"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.NukeSped","antivirusDetections":{"malicious":23,"total":25},"behavioralIndicators":{"malicious":10,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T142c,Found reference to API (Indicator: "LCMapStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderPathA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "IsBadWritePtr"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "IsBadReadPtr"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "IsBadCodePtr"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin")26:T405,Pattern match: "http://ocsp.digicert.com0c", Pattern match: "http://crl4.digicert.com/assured-cs-2011a.crl0", Pattern match: "crl4.digicert.com/digicertassuredidrootca.crl0", Heuristic match: "..w .in..ex...ec", Pattern match: "www.digicert.com1$0", Pattern match: "http://ocsp.digicert.com0l", Heuristic match: "s..etfi l.eti.me", Heuristic match: "geta . dap...ters in .fo", Heuristic match: "s etf.ile.p...oi n..t.er", Pattern match: "www.digicert.com1.0", Pattern match: "http://www.usertrust.com1", Pattern match: "www.google.com", Pattern match: "http://crl3.digicert.com/assured-cs-2011a.crl03", Pattern match: "http://ocsp.usertrust.com0", Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0", Pattern match: "www.amazon.com", Pattern match: "http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0", Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0", Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0", Pattern match: "crl.usertrust.com/utn-userfirst-object.crl05"27:T649,File "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.crt" is a certificate (Owner: CN=COMODO Time Stamping Signer, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB, Issuer: CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US, SerialNumber: 478a8efb59e1d83f0ce142d2a28707be, Valid From: 05/09/2010 19:00:00, Until: 05/10/2015 18:59:59, Fingerprints: MD5=67:F3:B0:A6:E9:0E:4A:02:BE:24:EC:A2:35:95:94:7D; SHA1=3D:BB:6D:B5:08:5C:6D:D5:A1:CA:7F:9C:F8:4E:CB:1A:39:10:CA:C8) File "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.crt" is a certificate (Owner: CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US, Issuer: CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US, SerialNumber: fa8490615d700a0be2176fdc5ec6dbd, Valid From: 02/11/2011 06:00:00, Until: 02/10/2026 06:00:00, Fingerprints: MD5=A1:D6:F2:DD:69:58:47:CF:6B:8D:D0:01:C7:D7:6E:72; SHA1=40:9A:A4:A7:4A:0C:DA:7C:0F:EE:6B:D0:BB:88:23:D1:6B:5F:18:75) File "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.crt" is a certificate (Owner: CN=Sony Pictures Entertainment Inc., O=Sony Pictures Entertainment Inc., L=CULVER CITY, ST=California, C=US, Issuer: CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US, SerialNumber: 1e2b4f759811c64379fca0be76d2dce, Valid From: 09/17/2012 19:00:00, Until: 09/22/2015 07:00:00, Fingerprints: MD5=88:A2:03:2E:16:2B:8C:31:3D:A1:D4:86:26:0D:25:C3; SHA1=8D:F4:6B:5F:DA:C2:EB:3B:47:57:F9:98:66:C1:99:FF:2B:13:42:7A)28:Taae,Found API call GetDiskFreeSpaceExW@KERNEL32.DLL (Target: "signed.exe"; Stream UID: "00018681-00001352-23127-125-00401900") which is directly followed by "cmp esi, 1Ah" and "jl 00401931h". See related instructions: "... +88 lea edx, dword ptr [esp+0Ch] +92 lea eax, dword ptr [esp+14h] +96 push edx +97 lea ecx, dword ptr [esp+20h] +101 push eax +102 lea edx, dword ptr [esp+2Ch] +106 push ecx +107 push edx +108 call dword ptr [00413F88h] ;GetDiskFreeSpaceExW +114 mov eax, dword ptr [esp+0Ch] +118 mov edx, dword ptr [edi+00000140h] +124 mov ecx, dword ptr [esp+10h] +128 add edx, eax +130 mov dword ptr [edi+00000140h], edx +136 mov edx, dword ptr [edi+00000144h] +142 adc edx, ecx +144 mov ecx, dword ptr [edi+00000138h] +150 mov eax, dword ptr [esp+18h] +154 mov dword ptr [edi+00000144h], edx +160 mov edx, dword ptr [esp+14h] +164 add ecx, edx +166 mov dword ptr [edi+00000138h], ecx +172 mov ecx, dword ptr [edi+0000013Ch] +178 adc ecx, eax +180 mov dword ptr [edi+0000013Ch], ecx +186 xor ecx, ecx +188 xor edx, edx +190 mov dword ptr [esp+0Ch], ecx +194 mov dword ptr [esp+14h], edx +198 mov dword ptr [esp+10h], ecx +202 mov dword ptr [esp+18h], edx +206 inc esi +207 cmp esi, 1Ah +210 jl 00401931h" ... at 00018681-00001352-23127-125-00401900 Found API call GetSystemTime@KERNEL32.DLL (Target: "signed.exe"; Stream UID: "00018681-00001352-23127-152-00406917") which is directly followed by "cmp ax, word ptr [004140A2h]" and "jne 0040697Ch". See related instructions: "... +23 call dword ptr [0040F070h] ;GetSystemTime +29 mov ax, word ptr [ebp-16h] +33 cmp ax, word ptr [004140A2h] +40 jne 0040697Ch" ... at 00018681-00001352-23127-152-00406917 Found API call GetDiskFreeSpaceExW@KERNEL32.DLL (Target: "signed.exe"; Stream UID: "00018681-00001352-28409-88-00402870") which is directly followed by "cmp esi, 1Ah" and "jl 004028B8h". See related instructions: "... +132 call dword ptr [00413F88h] ;GetDiskFreeSpaceExW +138 mov edx, dword ptr [esp+30h] +142 mov ecx, dword ptr [esp+10h] +146 mov eax, dword ptr [esp+14h] +150 mov dword ptr [esp+edx*8+0000016Ch], ecx +157 mov ecx, dword ptr [esp+30h] +161 mov edx, dword ptr [esp+08h] +165 mov dword ptr [esp+ecx*8+00000170h], eax +172 mov eax, dword ptr [esp+30h] +176 mov ecx, dword ptr [esp+0Ch] +180 mov dword ptr [esp+eax*8+0000009Ch], edx +187 mov edx, dword ptr [esp+30h] +191 mov dword ptr [esp+edx*8+000000A0h], ecx +198 mov eax, dword ptr [esp+30h] +202 inc eax +203 mov dword ptr [esp+30h], eax +207 xor eax, eax +209 xor ecx, ecx +211 mov dword ptr [esp+10h], eax +215 mov dword ptr [esp+08h], ecx +219 mov dword ptr [esp+14h], eax +223 mov dword ptr [esp+0Ch], ecx +227 inc esi +228 cmp esi, 1Ah +231 jl 004028B8h" ... at 00018681-00001352-28409-88-0040287029:T4ea,"signed.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003928) "signed.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003928)2a:T3a94,"signed.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter Module32FirstW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter VirtualFreeEx (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter ntohs (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter listen (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter gethostbyname (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter accept (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter __WSAFDIsSet (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegCreateKeyW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegOpenKeyA (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter DeleteService (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter ChangeServiceConfig2W (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter StartServiceCtrlDispatcherW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter RegisterServiceCtrlHandlerW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter EnumServicesStatusW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter QueryServiceConfig2W (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CreateServiceW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter SetServiceStatus (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetAdaptersInfo (UID: 00000000-00003928) "signed.exe" called "GetProcAddress" with a parameter GetTcpTable (UID: 00000000-00003928)2b:T454,"signed.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x40f1a8,push 0x40bbf8,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x58,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,call dword ptr [0x40f0a0],xor edx, edx,mov dl, ah,mov dword ptr [0x4140d0], edx,mov ecx, eax,and ecx, 0xff,mov dword ptr [0x4140cc], ecx,shl ecx, 8,add ecx, edx,mov dword ptr [0x4140c8], ecx,shr eax, 0x10,mov dword ptr [0x4140c4], eax,xor esi, esi,push esi,call 0x409c02,pop ecx,test eax, eax,jne 0x4076da," "signed.exe.bin" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x40f1a8,push 0x40bbf8,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x58,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,call dword ptr [0x40f0a0],xor edx, edx,mov dl, ah,mov dword ptr [0x4140d0], edx,mov ecx, eax,and ecx, 0xff,mov dword ptr [0x4140cc], ecx,shl ecx, 8,add ecx, edx,mov dword ptr [0x4140c8], ecx,shr eax, 0x10,mov dword ptr [0x4140c4], eax,xor esi, esi,push esi,call 0x409c02,pop ecx,test eax, eax,jne 0x4076da,"2c:T52b,"signed.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "signed.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "signed.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "signed.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "signed.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "signed.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "signed.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "signed.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "signed.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "signed.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "signed.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")2d:T9d4,"signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "SIGNED.EXE"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")2e:T8f3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003928.00000000.152681.03320000.00000004.mdmp, 00000000-00003928.00000001.154602.03320000.00000004.mdmp, 00000000-00003928.00000002.156522.03320000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003928.00000000.152681.03320000.00000004.mdmp, 00000000-00003928.00000001.154602.03320000.00000004.mdmp, 00000000-00003928.00000002.156522.03320000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003928.00000000.152681.03320000.00000004.mdmp, 00000000-00003928.00000001.154602.03320000.00000004.mdmp, 00000000-00003928.00000002.156522.03320000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003928.00000000.152681.03320000.00000004.mdmp, 00000000-00003928.00000001.154602.03320000.00000004.mdmp, 00000000-00003928.00000002.156522.03320000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003928.00000000.152681.03320000.00000004.mdmp, 00000000-00003928.00000001.154602.03320000.00000004.mdmp, 00000000-00003928.00000002.156522.03320000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003928.00000000.152681.03320000.00000004.mdmp, 00000000-00003928.00000001.154602.03320000.00000004.mdmp, 00000000-00003928.00000002.156522.03320000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003928.00000000.152681.03320000.00000004.mdmp, 00000000-00003928.00000001.154602.03320000.00000004.mdmp, 00000000-00003928.00000002.156522.03320000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003928.00000000.152681.03320000.00000004.mdmp, 00000000-00003928.00000001.154602.03320000.00000004.mdmp, 00000000-00003928.00000002.156522.03320000.00000004.mdmp")2f:T99e,"signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "signed.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")30:T542,Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin Observed string: "VirtualAllocEx" (Indicator: "VirtualAlloc") in Source: 00000000-00003084-00000C1E-15569361 Observed string: "VirtualFreeEx" (Indicator: "VirtualFree") in Source: 00000000-00003084-00000C1E-15571563 Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00003028.00000000.79799.0040F000.00000002.mdmp Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00003028.00000000.79799.0040F000.00000002.mdmp Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00003084.00000000.68038.0040F000.00000002.mdmp 00000000-00003084.00000001.69960.0040F000.00000002.mdmp 00000000-00003084.00000002.71877.0040F000.00000002.mdmp 00000000-00003084.00000003.79304.0040F000.00000002.mdmp Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00003084.00000000.68038.0040F000.00000002.mdmp 00000000-00003084.00000001.69960.0040F000.00000002.mdmp 00000000-00003084.00000002.71877.0040F000.00000002.mdmp 00000000-00003084.00000003.79304.0040F000.00000002.mdmp31:T414,Observed string: "GetVersion " [Source: 4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin] Observed string: "GetVersionExA " [Source: 4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin] Observed string: "GetVersionExW " [Source: 00000000-00003084-00000C1E-15552395] Observed string: "GetVersion " [Source: 00000000-00003028.00000000.79799.0040F000.00000002.mdmp] Observed string: "GetVersionExA " [Source: 00000000-00003028.00000000.79799.0040F000.00000002.mdmp] Observed string: "GetVersion " [Source: 00000000-00003084.00000000.68038.0040F000.00000002.mdmp 00000000-00003084.00000001.69960.0040F000.00000002.mdmp 00000000-00003084.00000002.71877.0040F000.00000002.mdmp 00000000-00003084.00000003.79304.0040F000.00000002.mdmp] Observed string: "GetVersionExA " [Source: 00000000-00003084.00000000.68038.0040F000.00000002.mdmp 00000000-00003084.00000001.69960.0040F000.00000002.mdmp 00000000-00003084.00000002.71877.0040F000.00000002.mdmp 00000000-00003084.00000003.79304.0040F000.00000002.mdmp]32:Ta88c,Found string "GetLastActivePopup" (Indicator: "GetLastActivePopup"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "MessageBoxA" (Indicator: "MessageBoxA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetTickCount" (Indicator: "GetTickCount"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetACP" (Indicator: "GetACP"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetComputerNameW" (Indicator: "GetComputerName"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetComputerNameW" (Indicator: "GetComputerNameW"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetDriveTypeW" (Indicator: "GetDriveTypeW"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "LocalAlloc" (Indicator: "LocalAlloc"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "Sleep" (Indicator: "Sleep"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "MoveFileA" (Indicator: "MoveFile"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "MoveFileA" (Indicator: "MoveFileA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetModuleFileNameA" (Indicator: "GetModuleFileNameA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetProcAddress" (Indicator: "GetProcAddress"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "lstrcpyA" (Indicator: "lstrcpyA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "lstrlenA" (Indicator: "lstrlenA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "SHGetSpecialFolderPathA" (Indicator: "SHGetSpecialFolderPathA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetSystemTime" (Indicator: "GetSystemTime"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetLocalTime" (Indicator: "GetLocalTime"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "RtlUnwind" (Indicator: "RtlUnwind"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetLastError" (Indicator: "GetLastError"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetFileAttributesW" (Indicator: "GetFileAttributesW"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "HeapAlloc" (Indicator: "HeapAlloc"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "HeapFree" (Indicator: "HeapFree"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetStartupInfoA" (Indicator: "GetStartupInfoA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLineA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetVersion" (Indicator: "GetVersion"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "ExitProcess" (Indicator: "ExitProcess"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "HeapReAlloc" (Indicator: "HeapReAlloc"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "TerminateProcess" (Indicator: "TerminateProcess"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "HeapSize" (Indicator: "HeapSize"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariable"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariableA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetVersionExA" (Indicator: "GetVersion"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetVersionExA" (Indicator: "GetVersionExA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "HeapDestroy" (Indicator: "HeapDestroy"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "HeapCreate" (Indicator: "HeapCreate"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "VirtualFree" (Indicator: "VirtualFree"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "IsBadWritePtr" (Indicator: "IsBadWritePtr"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "CloseHandle" (Indicator: "CloseHandle"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "SetHandleCount" (Indicator: "SetHandleCount"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetStdHandle" (Indicator: "GetStdHandle"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetFileType" (Indicator: "GetFileType"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "SetFilePointer" (Indicator: "SetFilePointer"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "UnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "FreeEnvironmentStringsA" (Indicator: "FreeEnvironmentStringsA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "FreeEnvironmentStringsW" (Indicator: "FreeEnvironmentStringsW"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStringsW"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "WriteFile" (Indicator: "WriteFile"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "SetUnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "IsBadReadPtr" (Indicator: "IsBadReadPtr"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "IsBadCodePtr" (Indicator: "IsBadCodePtr"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "LCMapStringA" (Indicator: "LCMapStringA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "LCMapStringW" (Indicator: "LCMapStringW"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "SetStdHandle" (Indicator: "SetStdHandle"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "FlushFileBuffers" (Indicator: "FlushFileBuffers"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetCPInfo" (Indicator: "GetCPInfo"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetOEMCP" (Indicator: "GetOEMCP"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetStringTypeA" (Indicator: "GetStringTypeA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetStringTypeW" (Indicator: "GetStringTypeW"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "CompareStringA" (Indicator: "CompareStringA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "CompareStringW" (Indicator: "CompareStringW"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "SetEnvironmentVariableA" (Indicator: "SetEnvironmentVariable"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "SetEnvironmentVariableA" (Indicator: "SetEnvironmentVariableA"; File: "4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin") Found string "GetTcpTable" (Indicator: "GetTcpTable"; File: "00000000-00003084.00000003.79304.00401000.00000020.mdmp") Found string "GetLastActivePopup" (Indicator: "GetLastActivePopup"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "MessageBoxA" (Indicator: "MessageBoxA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetACP" (Indicator: "GetACP"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetComputerNameW" (Indicator: "GetComputerName"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetComputerNameW" (Indicator: "GetComputerNameW"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "LocalAlloc" (Indicator: "LocalAlloc"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "Sleep" (Indicator: "Sleep"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "MoveFileA" (Indicator: "MoveFileA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetModuleFileNameA" (Indicator: "GetModuleFileNameA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "lstrcpyA" (Indicator: "lstrcpyA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "lstrlenA" (Indicator: "lstrlenA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "SHGetSpecialFolderPathA" (Indicator: "SHGetSpecialFolderPathA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "RtlUnwind" (Indicator: "RtlUnwind"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetFileAttributesW" (Indicator: "GetFileAttributesW"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "HeapAlloc" (Indicator: "HeapAlloc"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "HeapFree" (Indicator: "HeapFree"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetStartupInfoA" (Indicator: "GetStartupInfoA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLineA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "HeapReAlloc" (Indicator: "HeapReAlloc"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "HeapSize" (Indicator: "HeapSize"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "HeapDestroy" (Indicator: "HeapDestroy"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "HeapCreate" (Indicator: "HeapCreate"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "IsBadWritePtr" (Indicator: "IsBadWritePtr"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "CloseHandle" (Indicator: "CloseHandle"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "SetHandleCount" (Indicator: "SetHandleCount"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetStdHandle" (Indicator: "GetStdHandle"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetFileType" (Indicator: "GetFileType"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "SetFilePointer" (Indicator: "SetFilePointer"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "UnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "FreeEnvironmentStringsA" (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "FreeEnvironmentStringsW" (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "SetUnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "IsBadReadPtr" (Indicator: "IsBadReadPtr"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "IsBadCodePtr" (Indicator: "IsBadCodePtr"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "LCMapStringA" (Indicator: "LCMapStringA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "LCMapStringW" (Indicator: "LCMapStringW"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "SetStdHandle" (Indicator: "SetStdHandle"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "FlushFileBuffers" (Indicator: "FlushFileBuffers"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetCPInfo" (Indicator: "GetCPInfo"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetOEMCP" (Indicator: "GetOEMCP"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetStringTypeA" (Indicator: "GetStringTypeA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetStringTypeW" (Indicator: "GetStringTypeW"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "CompareStringA" (Indicator: "CompareStringA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "CompareStringW" (Indicator: "CompareStringW"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "SetEnvironmentVariableA" (Indicator: "SetEnvironmentVariable"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "SetEnvironmentVariableA" (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00003028.00000000.79799.0040F000.00000002.mdmp") Found string "GetTcpTable" (Indicator: "GetTcpTable"; Source: "00000000-00003028.00000000.79799.00413000.00000004.mdmp") Found string "GetLastActivePopup" (Indicator: "GetLastActivePopup"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "MessageBoxA" (Indicator: "MessageBoxA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetACP" (Indicator: "GetACP"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetComputerNameW" (Indicator: "GetComputerName"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetComputerNameW" (Indicator: "GetComputerNameW"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "LocalAlloc" (Indicator: "LocalAlloc"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "Sleep" (Indicator: "Sleep"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "MoveFileA" (Indicator: "MoveFileA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetModuleFileNameA" (Indicator: "GetModuleFileNameA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "lstrcpyA" (Indicator: "lstrcpyA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "lstrlenA" (Indicator: "lstrlenA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "SHGetSpecialFolderPathA" (Indicator: "SHGetSpecialFolderPathA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "RtlUnwind" (Indicator: "RtlUnwind"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetFileAttributesW" (Indicator: "GetFileAttributesW"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "HeapAlloc" (Indicator: "HeapAlloc"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "HeapFree" (Indicator: "HeapFree"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetStartupInfoA" (Indicator: "GetStartupInfoA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLineA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "HeapReAlloc" (Indicator: "HeapReAlloc"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "HeapSize" (Indicator: "HeapSize"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "HeapDestroy" (Indicator: "HeapDestroy"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "HeapCreate" (Indicator: "HeapCreate"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "IsBadWritePtr" (Indicator: "IsBadWritePtr"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "CloseHandle" (Indicator: "CloseHandle"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "SetHandleCount" (Indicator: "SetHandleCount"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetStdHandle" (Indicator: "GetStdHandle"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetFileType" (Indicator: "GetFileType"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "SetFilePointer" (Indicator: "SetFilePointer"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "UnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "FreeEnvironmentStringsA" (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "FreeEnvironmentStringsW" (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "SetUnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "IsBadReadPtr" (Indicator: "IsBadReadPtr"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "IsBadCodePtr" (Indicator: "IsBadCodePtr"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "LCMapStringA" (Indicator: "LCMapStringA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "LCMapStringW" (Indicator: "LCMapStringW"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "SetStdHandle" (Indicator: "SetStdHandle"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "FlushFileBuffers" (Indicator: "FlushFileBuffers"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetCPInfo" (Indicator: "GetCPInfo"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetOEMCP" (Indicator: "GetOEMCP"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetStringTypeA" (Indicator: "GetStringTypeA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetStringTypeW" (Indicator: "GetStringTypeW"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "CompareStringA" (Indicator: "CompareStringA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "CompareStringW" (Indicator: "CompareStringW"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "SetEnvironmentVariableA" (Indicator: "SetEnvironmentVariable"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "SetEnvironmentVariableA" (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00003084.00000000.68038.0040F000.00000002.mdmp, 00000000-00003084.00000001.69960.0040F000.00000002.mdmp, 00000000-00003084.00000002.71877.0040F000.00000002.mdmp, 00000000-00003084.00000003.79304.0040F000.00000002.mdmp") Found string "GetTcpTable" (Indicator: "GetTcpTable"; Source: "00000000-00003084.00000000.68038.00413000.00000004.mdmp, 00000000-00003084.00000001.69960.00413000.00000004.mdmp, 00000000-00003084.00000002.71877.00413000.00000004.mdmp, 00000000-00003084.00000003.79304.00413000.00000004.mdmp")33:Te07,Found string "VBoxService.exe" (Indicator: "vboxservice.exe"; File: "00000000-00003084.00000000.68038.00600000.00000004.mdmp") Found string "VBoxTray.exe" (Indicator: "vboxtray.exe"; File: "00000000-00003084.00000000.68038.00600000.00000004.mdmp") Found string "AutoIt3.exe" (Indicator: "autoit3.exe"; File: "00000000-00003084.00000000.68038.00600000.00000004.mdmp") Found string "tshark.exe" (Indicator: "tshark.exe"; File: "00000000-00003084.00000000.68038.00600000.00000004.mdmp") Found string "dumpcap.exe" (Indicator: "dumpcap.exe"; File: "00000000-00003084.00000000.68038.00600000.00000004.mdmp") Found string "VBoxService.exe" (Indicator: "vboxservice.exe"; Source: "00000000-00003028.00000000.79799.00240000.00000004.mdmp") Found string "VBoxTray.exe" (Indicator: "vboxtray.exe"; Source: "00000000-00003028.00000000.79799.00240000.00000004.mdmp") Found string "AutoIt3.exe" (Indicator: "autoit3.exe"; Source: "00000000-00003028.00000000.79799.00240000.00000004.mdmp") Found string "tshark.exe" (Indicator: "tshark.exe"; Source: "00000000-00003028.00000000.79799.00240000.00000004.mdmp") Found string "VxKernelSvcNTMgr.exe" (Indicator: "vxkernelsvcntmgr.exe"; Source: "00000000-00003028.00000000.79799.00240000.00000004.mdmp") Found string "dumpcap.exe" (Indicator: "dumpcap.exe"; Source: "00000000-00003028.00000000.79799.00240000.00000004.mdmp") Found string ":\Windows\System32\VBoxService.exe" (Indicator: "vboxservice.exe"; Source: "00000000-00003028.00000000.79799.00A30000.00000002.mdmp") Found string ":\Program Files\Wireshark\dumpcap.exe" (Indicator: "dumpcap.exe"; Source: "00000000-00003028.00000000.79799.00A30000.00000002.mdmp") Found string ":\Program Files\Wireshark\tshark.exe" (Indicator: "tshark.exe"; Source: "00000000-00003028.00000000.79799.00A30000.00000002.mdmp") Found string "VBoxService.exe" (Indicator: "vboxservice.exe"; Source: "00000000-00003084.00000000.68038.00600000.00000004.mdmp, 00000000-00003084.00000001.69960.00600000.00000004.mdmp, 00000000-00003084.00000002.71877.00600000.00000004.mdmp, 00000000-00003084.00000003.79304.00600000.00000004.mdmp") Found string "VBoxTray.exe" (Indicator: "vboxtray.exe"; Source: "00000000-00003084.00000000.68038.00600000.00000004.mdmp, 00000000-00003084.00000001.69960.00600000.00000004.mdmp, 00000000-00003084.00000002.71877.00600000.00000004.mdmp, 00000000-00003084.00000003.79304.00600000.00000004.mdmp") Found string "AutoIt3.exe" (Indicator: "autoit3.exe"; Source: "00000000-00003084.00000000.68038.00600000.00000004.mdmp, 00000000-00003084.00000001.69960.00600000.00000004.mdmp, 00000000-00003084.00000002.71877.00600000.00000004.mdmp, 00000000-00003084.00000003.79304.00600000.00000004.mdmp") Found string "tshark.exe" (Indicator: "tshark.exe"; Source: "00000000-00003084.00000000.68038.00600000.00000004.mdmp, 00000000-00003084.00000001.69960.00600000.00000004.mdmp, 00000000-00003084.00000002.71877.00600000.00000004.mdmp, 00000000-00003084.00000003.79304.00600000.00000004.mdmp") Found string "VxKernelSvcNTMgr.exe" (Indicator: "vxkernelsvcntmgr.exe"; Source: "00000000-00003084.00000000.68038.00600000.00000004.mdmp, 00000000-00003084.00000001.69960.00600000.00000004.mdmp, 00000000-00003084.00000002.71877.00600000.00000004.mdmp, 00000000-00003084.00000003.79304.00600000.00000004.mdmp") Found string "dumpcap.exe" (Indicator: "dumpcap.exe"; Source: "00000000-00003084.00000000.68038.00600000.00000004.mdmp, 00000000-00003084.00000001.69960.00600000.00000004.mdmp, 00000000-00003084.00000002.71877.00600000.00000004.mdmp, 00000000-00003084.00000003.79304.00600000.00000004.mdmp")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790440713195,"unified_at":"2026-09-26T16:38:33.195Z","metadata":{"hashes":{"sha256":"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","sha1":"8397c1e1f0b9d53a114850f6b3ae8c1f2b2d1590","md5":"e904bf93403c0fb08b9683a9e858c73e","sha512":"d83f63737f7fcac9179ca262aa5c32bba7e140897736b63474afcf4f972ffb4c317c5e1d6f7ebe6a0f2d77db8f41204031314d7749c7185ec3e3b5286d77c1a3","ssdeep":"1536:3bhwBno+Kv2reOvKOxSrTue9381wrtoKp4Ag7iPW:onBm2rrv/aTuH1otoKp4Ahu","ssdeep_chunks":["1536:3bhwBno","1536:bhwBno+","1536:hwBno+K","1536:wBno+Kv","1536:Bno+Kv2","1536:no+Kv2r","1536:o+Kv2re","1536:+Kv2reO","1536:Kv2reOv","1536:v2reOvK","1536:2reOvKO","1536:reOvKOx","1536:eOvKOxS","1536:OvKOxSr","1536:vKOxSrT","1536:KOxSrTu","1536:OxSrTue","1536:xSrTue9","1536:SrTue93","1536:rTue938","1536:Tue9381","1536:ue9381w","1536:e9381wr","1536:9381wrt","1536:381wrto","1536:81wrtoK","1536:1wrtoKp","1536:wrtoKp4","1536:rtoKp4A","1536:toKp4Ag","1536:oKp4Ag7","1536:Kp4Ag7i","1536:p4Ag7iP","1536:4Ag7iPW","3072:3bhwBno","3072:bhwBno+","3072:hwBno+K","3072:wBno+Kv","3072:Bno+Kv2","3072:no+Kv2r","3072:o+Kv2re","3072:+Kv2reO","3072:Kv2reOv","3072:v2reOvK","3072:2reOvKO","3072:reOvKOx","3072:eOvKOxS","3072:OvKOxSr","3072:vKOxSrT","3072:KOxSrTu","3072:OxSrTue","3072:xSrTue9","3072:SrTue93","3072:rTue938","3072:Tue9381","3072:ue9381w","3072:e9381wr","3072:9381wrt","3072:381wrto","3072:81wrtoK","3072:1wrtoKp","3072:wrtoKp4","3072:rtoKp4A","3072:toKp4Ag","3072:oKp4Ag7","3072:Kp4Ag7i","3072:p4Ag7iP","3072:4Ag7iPW","1536:onBm2rr","1536:nBm2rrv","1536:Bm2rrv/","1536:m2rrv/a","1536:2rrv/aT","1536:rrv/aTu","1536:rv/aTuH","1536:v/aTuH1","1536:/aTuH1o","1536:aTuH1ot","1536:TuH1oto","1536:uH1otoK","1536:H1otoKp","1536:1otoKp4","1536:otoKp4A","1536:toKp4Ah","1536:oKp4Ahu"],"imphash":"c202168c041f0b6ad08f4597a4d165a3","pehash":"4527384a975783edcfb2c2a2b76f147a45b76e4e"},"file_info":{"file_name":"signed.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":91888,"entropy":5.76,"compile_timestamp":"2014-07-07T08:01:09","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499288153000,"last_seen":1788014178000,"last_multi_scan":1788014178000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":4,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":56565,"raw_size":57344},{"name":".rdata","virtual_address":"0xf000","virtual_size":3464,"raw_size":4096},{"name":".data","virtual_address":"0x10000","virtual_size":22268,"raw_size":16384},{"name":".rsrc","virtual_address":"0x16000","virtual_size":1088,"raw_size":4096}],"section_names":[".text",".rdata",".data",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","criminal","destructive/wiper","escad","gop","gopwiper","guardianofpeace","kordll/hawup","labyrinthchollima","nukesped","operationtroy","rat","silentchollima","suspicious","targeted","targetedcrimeware","whoisteam"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":61},"sandbox_signatures":{"informative_count":138,"suspicious_count":19,"malicious_count":10,"total":167},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win32.Escad","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Destover","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Destover.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.NukeSped.89","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.HardRain-6473321-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Backdoor_Win32_Escad_A_dha","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.NukeSped.89 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/NukeSped.E trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.Destover.d.gaoe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Malware.Win32.GenericMC.cc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Escad.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00689bc41 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Destover.tnpc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Destover-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Destover.91888","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Generic.yx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.SYBH-9384","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DownLoader11.CUNA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Destover.Win32.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.NukeSped","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"KorDLL/Hawup","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to query the machine version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains the ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Rename files"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"suspicious","value":"Looks up many procedures within the same disassembly stream (often used to hide usage)"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to write data into process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"suspicious","value":"Contains ability to obtains specified information about the security of a file or directory"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/open registry keys (API string)"},{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with low confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"low\" confidence","origin":"Static Analysis","id":"mlmodel-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with bottom confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-19","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStrings\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"203.131.222.102\", \"208.105.226.235\", \"0.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStrings\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-122","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00539906-00003936-29162-43-00406917","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"203.131.222.102:443\"\n \"208.105.226.235:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.crt\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00539906-00003936-29162-237-00409ABA\n GetVersion@KERNEL32.DLL at 00539906-00003936-29162-292-00407684\n GetVersion@KERNEL32.DLL at 00539906-00003936-34046-1-0040766E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"Environment Awareness","name":"Makes a branch decision directly after calling an API that is environment aware","description":"Found API call GetSystemTime@KERNEL32.DLL (Target: \"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c\", Stream UID: \"00539906-00003936-29162-43-00406917\")\n which is directly followed by \"cmp ax, word ptr [004140A2h]\" and \"jne 0040697Ch\". See related instructions: \"...\n+23 call dword ptr [0040F070h] ;GetSystemTime\n+29 mov ax, word ptr [ebp-16h]\n+33 cmp ax, word ptr [004140A2h]\n+40 jne 0040697Ch\" ... at 00539906-00003936-29162-43-00406917","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"The input sample dropped/contains a certificate file","description":"$27","origin":"Binary File","relevance":10,"id":"binary-12","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 203.131.222.102 on port 443 is sent without HTTP header\n TCP traffic to 208.105.226.235 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetTickCount\n GetComputerNameW\n GetDriveTypeW\n Sleep\n GetModuleFileNameA\n GetProcAddress\n LoadLibraryA\n WriteFile\n GetFileAttributesW\n GetModuleHandleA\n GetStartupInfoA\n GetCommandLineA\n TerminateProcess\n GetVersionExA\n VirtualAlloc\n UnhandledExceptionFilter\n send (Ordinal #19)\n recv (Ordinal #16)\n connect (Ordinal #4)\n closesocket (Ordinal #3)\n socket (Ordinal #23)","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"45/56 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"45/56 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Proxy_Tool_3\" matched file \"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin\" as \"Targeted Destructive Malware - Proxy Tool\" based on indicators: \"8a04178bfb34a746880283c9ff\" (Reference: https://www.us-cert.gov/ncas/alerts/TA14-353A)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00018681-00001352-23127-157-0040C0F3\n GetTimeZoneInformation@KERNEL32.DLL at 00018681-00001352-23127-152-00406917","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00018681-00001352-23127-88-00402870\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00018681-00001352-23127-125-00401900\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00018681-00001352-28409-88-00402870","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$28","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"crl4.digicert.com\"\n \"crl3.digicert.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US\" (SHA1: 3D:BB:6D:B5:08:5C:6D:D5:A1:CA:7F:9C:F8:4E:CB:1A:39:10:CA:C8; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 40:9A:A4:A7:4A:0C:DA:7C:0F:EE:6B:D0:BB:88:23:D1:6B:5F:18:75; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 8D:F4:6B:5F:DA:C2:EB:3B:47:57:F9:98:66:C1:99:FF:2B:13:42:7A; see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\tzres.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 61 calls to GetProcAddress@KERNEL32.DLL at 00018681-00001352-23127-190-00404180\n Found 28 calls to GetProcAddress@KERNEL32.DLL at 00018681-00001352-23127-188-004047E0\n Found 20 calls to GetProcAddress@KERNEL32.DLL at 00018681-00001352-23127-189-00404AE0\n Found 28 calls to GetProcAddress@KERNEL32.DLL at 00018681-00001352-28409-188-004047E0\n Found 20 calls to GetProcAddress@KERNEL32.DLL at 00018681-00001352-28409-189-00404AE0\n Found 61 calls to GetProcAddress@KERNEL32.DLL at 00018681-00001352-28409-190-00404180","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00018681-00001352-23127-126-00401730\n Module32FirstW@KERNEL32.DLL at 00018681-00001352-23127-104-00403640\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00018681-00001352-23127-105-00403AA0\n Module32FirstW@KERNEL32.DLL at 00018681-00001352-28409-104-00403640","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\signed.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"signed.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"signed.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00003928.00000002.156522.0040F000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003928.00000002.156522.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003928.00000000.152681.03320000.00000004.mdmp, 00000000-00003928.00000001.154602.03320000.00000004.mdmp, 00000000-00003928.00000002.156522.03320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"signed.exe\" renamed original file\"C:\\signed.exe\" to \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\signed.exe\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor ebp\n ecx in Stream UID: 00000000-00003928-16641-38-00405E70\n Assembly shows XOR instruction xor esi\n eax in Stream UID: 00000000-00003928-16641-39-00405DD0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Spawned process connects to a network\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contacts server","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"signed.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003928)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"signed.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b785f81acf90f010000000054fb0f01506ada77536cb2f7fefffffff9ded577a59916750310000000000000000000000010000000000000000000000000000064fb0f01f9ded577 (UID: 00000000-00003928)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"signed.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"signed.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003928)\n \"signed.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003928)\n \"signed.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003928)\n \"signed.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00003928)\n \"signed.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00003928)\n \"signed.exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00003928)\n \"signed.exe\" called \"LoadLibrary\" with a parameter Advapi32.dll (UID: 00000000-00003928)\n \"signed.exe\" called \"LoadLibrary\" with a parameter iphlpapi.dll (UID: 00000000-00003928)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"signed.exe\" called \"MoveFileA\" with parameter C:\\signed.exe & %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\signed.exe (UID: 00000000-00003928)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: signed.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: signed.exe.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\signed.exe\" (Indicator: \"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\signed.exe\") in Source: 00000000-00003928-00000C53-1391378235\n \":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00003928.00000000.152681.03320000.00000004.mdmp\n 00000000-00003928.00000001.154602.03320000.00000004.mdmp\n 00000000-00003928.00000002.156522.03320000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"signed.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 75060000\n \"signed.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 75060000\n \"signed.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 75060000\n \"signed.exe\" loaded module \"KERNEL32\" at base 76bb0000\n \"signed.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 733d0000\n \"signed.exe\" loaded module \"KERNEL32.DLL\" at base 76bb0000\n \"signed.exe\" loaded module \"WS2_32.DLL\" at base 770f0000\n \"signed.exe\" loaded module \"ADVAPI32.DLL\" at base 778a0000\n \"signed.exe\" loaded module \"IPHLPAPI.DLL\" at base 74670000\n \"signed.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSWSOCK.DLL\" at base 73450000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"signed.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74840000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"signed.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77020000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"signed.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"signed.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"signed.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"signed.exe.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"signed.exe.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"signed.exe.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"signed.exe\" has an executable section named \".text\"\n \"signed.exe.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"signed.exe\" has an writable section named \".data\"\n \"signed.exe.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"signed.exe\" (UID: 00000000-00001060) was launched with new environment variables: \"PROMPT=\"$P$G\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"signed.exe\" (UID: 00000000-00001060) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"signed.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"signed.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"signed.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"signed.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"signed.exe.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"signed.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"signed.exe\" queries basic process information of the \"C:\\signed.exe\" (UID: 3928)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"signed.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"signed.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"signed.exe\" trying to touch file \"C:\\signed.exe\"\n \"signed.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"signed.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"signed.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"signed.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"signed.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\win32u.dll\"\n \"signed.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"\n \"signed.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcp_win.dll\"\n \"signed.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32full.dll\"\n \"signed.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32.dll\"\n \"signed.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\user32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"signed.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"signed.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"signed.exe\" trying to access non-existent file \"C:\\IPHLPAPI.DLL\"\n \"signed.exe\" trying to access non-existent file \"C:\\iphlpapi.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003928-00000C29-1391433395\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"signed.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"203.131.222.102\" on port \"443\"\n HTTPS traffic to \"208.105.226.235\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"signed.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: signed.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: signed.exe.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003928.00000000.152681.03320000.00000004.mdmp, 00000000-00003928.00000001.154602.03320000.00000004.mdmp, 00000000-00003928.00000002.156522.03320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: signed.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"signed.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"signed.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"signed.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"signed.exe\" queried SystemProcessInformation at 00000000-00003928-00000C13-1391273745 [PID: 3928]\n \"signed.exe\" queried SystemProcessInformation at 00000000-00003928-00000C13-1391281562 [PID: 3928]\n \"signed.exe\" queried SystemProcessInformation at 00000000-00003928-00000C13-1391496008 [PID: 3928]\n \"signed.exe\" queried SystemProcessInformation at 00000000-00003928-00000C13-1391504346 [PID: 3928]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"signed.exe\" has section name .text with entropy \"6.54661619439\"\n \"signed.exe.bin\" has section name .text with entropy \"6.54661619439\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"signed.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\signed.exe\" connects to 203.131.222.102 on port 443 (TCP)\n Process \"C:\\signed.exe\" connects to 208.105.226.235 on port 443 (TCP)\n Process \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\signed.exe\" connects to 208.105.226.235 on port 443 (TCP)\n Process \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\signed.exe\" connects to 203.131.222.102 on port 443 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"19/22 Antivirus vendors marked dropped file \"signed.exe.bin\" as malicious (classified as \"Trojan.Destover\" with 86% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate was explicitly revoked by its issuer. (0x800b010c)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Observed string: \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\") in Source: 00000000-00003084-00000C1E-15506281\n Observed string: \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\") in Source: 00000000-00003084-00000C1E-15516823","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00003084-00000C1E-15500655\n Observed string: \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\") in Source: 00000000-00003028-00000C1E-86828519","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00003084-00000C1E-15724832\n Observed string: \"OpenThreadToken\" (Indicator: \"OpenThreadToken\") in Source: 00000000-00003084-00000C1E-28704082","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Observed string: \"SetFileTime\" (Indicator: \"SetFileTime\") in Source: 00000000-00003084-00000C1E-15542016","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write data into process memory (API string)","description":"Observed string: \"WriteProcessMemory\" [Source: 00000000-00003084-00000C1E-15570461]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Observed string: \"ChangeServiceConfig2W\" [Source: 00000000-00003084-00000C1E-15718101]","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Rename files","description":"\"signed.exe\" renamed original file\"C:\\signed.exe\" to \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\signed.exe\"\n \"signed.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\signed.exe\" to \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\signed.exe\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\"signed.exe\" called \"IsWow64Process\" with parameter \"3028\" - (UID: 00000000-00003028)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00003084-7741-146-00401130\n GetTickCount@KERNEL32.DLL at 00000000-00003084-7741-7-00401040\n GetTickCount@KERNEL32.DLL at 00000000-00003084-7741-97-004030F0\n GetTickCount@KERNEL32.DLL at 00000000-00003084-7741-182-00405DD0\n GetTickCount@KERNEL32.DLL at 00000000-00003084-12418-7-00401040\n GetTickCount@KERNEL32.DLL at 00000000-00003084-12418-146-00401130\n GetTickCount@KERNEL32.DLL at 00000000-00003028-16807-182-00405DD0\n GetTickCount@KERNEL32.DLL at 00000000-00003028-16807-97-004030F0\n GetTickCount@KERNEL32.DLL at 00000000-00003028-16807-146-00401130\n GetTickCount@KERNEL32.DLL at 00000000-00003028-16807-7-00401040","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00003084-7741-89-00402990\n FindFirstFileW@KERNEL32.DLL at 00000000-00003084-7741-83-00402640\n FindFirstFileW@KERNEL32.DLL at 00000000-00003084-12418-83-00402640\n FindFirstFileW@KERNEL32.DLL at 00000000-00003028-16807-89-00402990\n FindFirstFileW@KERNEL32.DLL at 00000000-00003028-16807-83-00402640","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00003084-7741-125-00401900\n GetLogicalDrives@KERNEL32.DLL at 00000000-00003084-7741-88-00402870\n GetLogicalDrives@KERNEL32.DLL at 00000000-00003028-16807-88-00402870\n GetLogicalDrives@KERNEL32.DLL at 00000000-00003028-16807-125-00401900","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Observed string: \"GetLocaleInfoEx\" [Source: 00000000-00003028-00000C1E-86863694]","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Observed string: \"GetDiskFreeSpaceExW\" [Source: 00000000-00003084-00000C1E-15545486]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Observed string: \"GetFileTime\" (Indicator: \"GetFileTime\") in Source: 00000000-00003084-00000C1E-15540919","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Observed string: \"GetVolumeInformation\" [Source: 00000000-00003084-00000C1E-15548996]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Observed string: \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\") in Source: 00000000-00003084-00000C1E-15762651","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00003084-00000C1E-15714251","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Observed string: \"CreateProcessW\" (Indicator: \"CreateProcess\") in Source: 00000000-00003084-00000C1E-15504017\n Observed string: \"CreateProcessA\" (Indicator: \"CreateProcess\") in Source: 00000000-00003084-00000C1E-15505133","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00003084-00000C1E-15509855","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"RegCreateKeyW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00003084-00000C1E-15701875\n Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00003084-00000C1E-15703004","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00003084-7741-139-00403EC0\n Sleep@KERNEL32.DLL at 00000000-00003084-7741-97-004030F0\n Sleep@KERNEL32.DLL at 00000000-00003028-16807-97-004030F0\n Sleep@KERNEL32.DLL at 00000000-00003028-16807-139-00403EC0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00003084-7741-186-00401110\n LoadLibraryA@KERNEL32.DLL at 00000000-00003084-7741-175-0040DBA0\n LoadLibraryA@KERNEL32.DLL at 00000000-00003084-7741-190-00404180\n LoadLibraryA@KERNEL32.DLL at 00000000-00003084-7741-188-004047E0\n LoadLibraryA@KERNEL32.DLL at 00000000-00003084-12418-190-00404180\n LoadLibraryA@KERNEL32.DLL at 00000000-00003084-12418-188-004047E0\n LoadLibraryA@KERNEL32.DLL at 00000000-00003028-16807-188-004047E0\n LoadLibraryA@KERNEL32.DLL at 00000000-00003028-16807-175-0040DBA0\n LoadLibraryA@KERNEL32.DLL at 00000000-00003028-16807-190-00404180\n LoadLibraryA@KERNEL32.DLL at 00000000-00003028-16807-186-00401110","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Observed string: \"WinExec\" (Indicator: \"WinExec\") in Source: 00000000-00003084-00000C1E-15508535","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Observed string: \"OpenProcess\" (Indicator: \"OpenProcess\") in Source: 00000000-00003084-00000C1E-15537563\n Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcess\") in Source: 00000000-00003084-00000C1E-15724832","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Observed string: \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\") in Source: 00000000-00003084-00000C1E-15719254\n Observed string: \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\") in Source: 00000000-00003084-00000C1E-15719254\n Observed string: \"StartServiceW\" (Indicator: \"StartService\") in Source: 00000000-00003084-00000C1E-15763782","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Winsock\" in Source: 00000000-00003084.00000000.68038.00600000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00003028.00000000.79799.0008C000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate system service (API string)","description":"Observed string: \"EnumServicesStatusW\" [Source: 00000000-00003084-00000C1E-15721482]\n Observed string: \"OpenSCManagerW\" [Source: 00000000-00003084-00000C1E-15757657]\n Observed string: \"OpenServiceW\" [Source: 00000000-00003084-00000C1E-15761548]","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"signed.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"signed.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1400150094a3dd732ced1800b8c0db73@ADVAPI32.dll\"\n \"14001500aca3dd732ced1800b8c0db73@ADVAPI32.dll\"\n \"14001500c4a3dd732ced1800b8c0db73@ADVAPI32.dll\"\n \"0d000e000090dd732ced1800b8c0db73@SHELL32.dll\"\n \"14001500aca3dd7324fa1800b8c0db73@ADVAPI32.dll\"\n \"14001500c4a3dd7324fa1800b8c0db73@ADVAPI32.dll\"\n \"0d000e000090dd7324fa1800b8c0db73@SHELL32.dll\"\n \"0d000e005490dd7324fa1800b8c0db73@SHELL32.dll\"\n \"150016002c8add7324fa1800b8c0db73@ADVAPI32.dll\"\n \"0e000f00a48add7324fa1800b8c0db73@ADVAPI32.dll\"\n \"0e000f00d88add7324fa1800b8c0db73@ADVAPI32.dll\"\n \"11001200388fdd7324fa1800b8c0db73@ADVAPI32.dll\"\n \"11001200a48fdd7324fa1800b8c0db73@ADVAPI32.dll\"\n \"12001300b88fdd7324fa1800b8c0db73@ADVAPI32.dll\"\n \"12001300e08fdd7324fa1800b8c0db73@ADVAPI32.dll\"\n \"1400150094a3dd7324fa1800b8c0db73@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"signed.exe\" (UID: 00000000-00003028)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"signed.exe\" (UID: 00000000-00003028)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"\"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"00000000-00003084-00000C1E-15720378\")\n \"CreateServiceW\" (Indicator: \"CreateService\"; File: \"00000000-00003084-00000C1E-15759077\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Observed string: \"WSAStartup\" (Indicator: \"WSAStartup\") in Source: 00000000-00003084-00000C1E-15620960","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00003028\"\n YARA signature for RC4 encryption matched on file \"signed.exe.bin\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00003084\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string: \"FindFirstFileW\" [Source: 00000000-00003084-00000C1E-15556833]\n Observed string: \"FindNextFileW\" [Source: 00000000-00003084-00000C1E-15557931]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed string: \"CreateToolhelp32Snapshot\" [Source: 00000000-00003084-00000C1E-15534087]\n Observed string: \"Process32FirstW\" [Source: 00000000-00003084-00000C1E-15535280]\n Observed string: \"Process32NextW\" [Source: 00000000-00003084-00000C1E-15536420]\n Observed string: \"Module32FirstW\" [Source: 00000000-00003084-00000C1E-15539807]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Observed string: \"GetLogicalDrives\" [Source: 00000000-00003084-00000C1E-15567114]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Observed string: \"GetAdaptersInfo\" [Source: 00000000-00003084-00000C1E-29122373]","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Observed string: \"ReadFile\" (Indicator: \"ReadFile\") in Source: 00000000-00003084-00000C1E-15519034","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-534","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"Observed string: \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\") in Source: 00000000-00003084-00000C1E-15704125\n Observed string: \"RegOpenKeyW\" (Indicator: \"RegOpenKey\") in Source: 00000000-00003084-00000C1E-15705238\n Observed string: \"RegOpenKeyA\" (Indicator: \"RegOpenKey\") in Source: 00000000-00003084-00000C1E-15706344\n Observed string: \"RegQueryValueExW\" (Indicator: \"RegQueryValue\") in Source: 00000000-00003084-00000C1E-15707470\n Observed string: \"RegQueryValueExA\" (Indicator: \"RegQueryValue\") in Source: 00000000-00003084-00000C1E-15708725","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string: \"GetSystemMetrics\" [Source: 4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.bin]\n Observed string: \"GetSystemInfo\" [Source: 00000000-00003084-00000C1E-15553507]\n Observed string: \"GetSystemMetrics\" [Source: 00000000-00003028.00000000.79799.0040F000.00000002.mdmp]\n Observed string: \"GetSystemMetrics\" [Source: 00000000-00003084.00000000.68038.0040F000.00000002.mdmp\n 00000000-00003084.00000001.69960.0040F000.00000002.mdmp\n 00000000-00003084.00000002.71877.0040F000.00000002.mdmp\n 00000000-00003084.00000003.79304.0040F000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames (API string)","description":"Observed string: \"GetUserNameW\" [Source: 00000000-00003084-00000C1E-15723712]","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files (API string)","description":"Observed string: \"DeleteFileW\" (Indicator: \"DeleteFile\") in Source: 00000000-00003084-00000C1E-15523564","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00003084-00000C1E-15715863","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed string: \"GetTokenInformation\" which can Retrieves a specified type of information about an access token. [Source: 00000000-00003084-00000C1E-15726115]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"$33","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"VBoxService.exe\" (Indicator: \"vbox\") in Source: 00000000-00003084.00000000.68038.00600000.00000004.mdmp\n \"VBoxService.exe\" (Indicator: \"vboxservice\") in Source: 00000000-00003084.00000000.68038.00600000.00000004.mdmp\n \"VBoxTray.exe\" (Indicator: \"vbox\") in Source: 00000000-00003084.00000000.68038.00600000.00000004.mdmp\n \"VBoxTray.exe\" (Indicator: \"vboxtray\") in Source: 00000000-00003084.00000000.68038.00600000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in File: \"00000000-00003084.00000000.68038.00600000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00003028.00000000.79799.00240000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00003084.00000000.68038.00600000.00000004.mdmp, 00000000-00003084.00000001.69960.00600000.00000004.mdmp, 00000000-00003084.00000002.71877.00600000.00000004.mdmp, 00000000-00003084.00000003.79304.00600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"GetTokenInformation@ADVAPI32.DLL at 00000000-00003084-7741-104-00403640\n GetTokenInformation@ADVAPI32.DLL at 00000000-00003084-12418-104-00403640\n GetTokenInformation@ADVAPI32.DLL at 00000000-00003028-16807-104-00403640","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory","description":"GetTokenInformation@ADVAPI32.DLL at 00000000-00003084-7741-104-00403640\n GetTokenInformation@ADVAPI32.DLL at 00000000-00003084-12418-104-00403640\n GetTokenInformation@ADVAPI32.DLL at 00000000-00003028-16807-104-00403640","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.001","relevance":3,"id":"stream-117","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"signed.exe\" wrote bytes \"7111ce007a3bcd00ab8b02007f950200fc8c0200729602006cc805001ecdca007d26ca00\" to virtual address \"0x76EE07E4\" (part of module \"USER32.DLL\")\n \"signed.exe\" wrote bytes \"7d07ba7781edb877ae86b777c6e0b677effdb9772d16b8776014ba77478db777a8e2b6776089b77700000000ad376a778b2d6a77b6416a7700000000\" to virtual address \"0x740F1000\" (part of module \"WSHTCPIP.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"61/70 Antivirus vendors marked spawned process \"signed.exe\" (PID: 3028) as malicious (classified as \"Trojan.Destover\" with 87% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to query network adapter information"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]}],"intel_graph":{"map":{"Domain:crl3.digicert.com":{"type":"Domain","value":"crl3.digicert.com"},"Domain:crl4.digicert.com":{"type":"Domain","value":"crl4.digicert.com"},"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c":{"type":"File","value":"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as trojan by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat KorDLL/Hawup"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:7bf7180e72dda1c66b7590d11e569f7e12c577334d3cafb7b3aa1b62554d96fa":{"type":"File","value":"7bf7180e72dda1c66b7590d11e569f7e12c577334d3cafb7b3aa1b62554d96fa","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"Ip:203.131.222.102":{"type":"Ip","value":"203.131.222.102"},"Ip:208.105.226.235":{"type":"Ip","value":"208.105.226.235"},"Ip:66.225.197.197":{"type":"Ip","value":"66.225.197.197"},"Threat:1df723b078b06f9321e6a9e77868a1cd8a3f39787d62895fb3616d384d5cd36a":{"type":"Threat","value":"KorDLL/Hawup","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1543268087075969606","root":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as trojan by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat KorDLL/Hawup"]}},{"id":"1543268078236370548","root":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","to_key":"File:7bf7180e72dda1c66b7590d11e569f7e12c577334d3cafb7b3aa1b62554d96fa"}],"verdict":{"verdict":"unknown"}},{"id":"1543268070008847481","root":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","to_key":"Threat:1df723b078b06f9321e6a9e77868a1cd8a3f39787d62895fb3616d384d5cd36a"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","edges":[{"edge_kind":"contacted_ip","from_key":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","to_key":"Ip:203.131.222.102"},{"edge_kind":"contacted_ip","from_key":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","to_key":"Ip:208.105.226.235"},{"edge_kind":"contacted_domain","from_key":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","to_key":"Domain:crl4.digicert.com"},{"edge_kind":"resolves_to","from_key":"Domain:crl4.digicert.com","to_key":"Ip:66.225.197.197"},{"edge_kind":"contacted_domain","from_key":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","to_key":"Domain:crl3.digicert.com"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","edges":[{"edge_kind":"extracted","from_key":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","to_key":"File:7bf7180e72dda1c66b7590d11e569f7e12c577334d3cafb7b3aa1b62554d96fa"},{"edge_kind":"extracted","from_key":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","to_key":"File:7bf7180e72dda1c66b7590d11e569f7e12c577334d3cafb7b3aa1b62554d96fa"},{"edge_kind":"extracted","from_key":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","to_key":"File:4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":67,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent","criminal","destructive/wiper","escad","gop","gopwiper","guardianofpeace","kordll/hawup","labyrinthchollima","nukesped","operationtroy","rat","silentchollima","suspicious","targeted","targetedcrimeware","whoisteam"],"sample_flags":["Network Traffic","Extracted Files","Multi-Process","Launch Failed"],"sandbox_reports":[{"id":"66c3f96a7f76a68b7201be42","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["THA","USA"],"submit_name":"signed.exe","analysis_start_time":"2024-08-20T02:03:23+00:00","indicators_count":{"informative":80,"suspicious":10,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true},{"id":"643e7a8627ed024e67061098","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Destover","contacted_countries":["THA","USA"],"submit_name":"signed.exe","analysis_start_time":"2023-04-18T11:09:59+00:00","indicators_count":{"informative":96,"suspicious":28,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true},{"id":"587ce88faac2ed3c7389ffd6","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Destover","contacted_countries":["THA","USA"],"submit_name":"signed.exe","analysis_start_time":"2017-01-16T16:37:59+00:00","indicators_count":{"informative":11,"suspicious":6,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"560f12860e316db04bdc19b6","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Destover","contacted_countries":["THA","USA"],"submit_name":"signed.exe","analysis_start_time":"2015-10-02T18:27:17+00:00","indicators_count":{"informative":3,"suspicious":7,"malicious":3},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"203.131.222.102","port":443,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]},{"address":"208.105.226.235","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"},{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]}],"dns_resolutions":[{"domain":"crl4.digicert.com","address":"66.225.197.197","country":"United States","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"}]},{"domain":"crl3.digicert.com","country":"-","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"}],"processes":[{"pid":3928,"ppid":0,"name":"signed.exe","command_line":"","sha256":"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","normalized_path":"C:\\signed.exe","uid":"00000000-00003928","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1060,"ppid":0,"name":"signed.exe","command_line":"","sha256":"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","normalized_path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\signed.exe","uid":"00000000-00001060","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["sechost.dll","PSAPI.DLL","kernel32.dll","iphlpapi.dll","WS2_32.dll","MSCTF.dll","RPCRT4.dll","DEVOBJ.dll","IMM32.DLL","KERNELBASE.dll","wshtcpip.dll","SHLWAPI.dll","SETUPAPI.dll","NSI.dll","VERSION.dll","SspiCli.dll","GDI32.dll","SHELL32.dll","LPK.dll","USP10.dll","CFGMGR32.dll","msvcrt.dll","ADVAPI32.dll","ole32.dll","mswsock.dll","USER32.dll","ntdll.dll","OLEAUT32.dll","KernelBase.dll","rpcrt4.dll","nsi.dll","IPHLPAPI.DLL","winnsi.dll","shell32.dll","ws2_32.dll","tzres.dll","shlwapi.dll","msctf.dll","WSHTCPIP.DLL","oleaut32.dll","user32.dll","gdi32.dll","lpk.dll","usp10.dll","imm32.dll","advapi32.dll","gdi32full.dll","msvcp_win.dll","bcryptprimitives.dll","combase.dll","windows.storage.dll","wow64.dll","kernel.appcore.dll","wow64cpu.dll","SHCore.dll","fltLib.dll","ucrtbase.dll","cryptbase.dll","wow64win.dll","apphelp.dll","sspicli.dll","powrprof.dll","VxSSL32.dll","cfgmgr32.dll","profapi.dll","win32u.dll","api-ms-win-core-synch-l1-2-0.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"7bf7180e72dda1c66b7590d11e569f7e12c577334d3cafb7b3aa1b62554d96fa","sha256":"7bf7180e72dda1c66b7590d11e569f7e12c577334d3cafb7b3aa1b62554d96fa","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c.crt","sha256":"7bf7180e72dda1c66b7590d11e569f7e12c577334d3cafb7b3aa1b62554d96fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"}]},{"name":"signed.exe.bin","sha256":"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"},{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"560f12860e316db04bdc19b6"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"587ce88faac2ed3c7389ffd6"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"66c3f96a7f76a68b7201be42"},{"report_type":"sandbox","report_id":"643e7a8627ed024e67061098"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["66c3f96a7f76a68b7201be42","643e7a8627ed024e67061098","587ce88faac2ed3c7389ffd6","560f12860e316db04bdc19b6"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.NukeSped Sample 4c2efe2f1253… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4c2efe2f1253…. Malware family: Trojan.NukeSped. Threat score 100/100. 23/25 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.NukeSped Sample 4c2efe2f1253… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4c2efe2f1253…. Malware family: Trojan.NukeSped. Threat score 100/100. 23/25 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.NukeSped Sample 4c2efe2f1253… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4c2efe2f1253…. Malware family: Trojan.NukeSped. Threat score 100/100. 23/25 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]