26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Worm/Autorun.ep Sample 541b3e954a3d… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 541b3e954a3d…. Malware family: Worm/Autorun.ep. Threat score 70/100. 1/25 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/541b3e954a3dc2b5fd498a13426b3c4fb863943794040eacb6d384bc881ac833","keywords":["Suspicious","Worm/Autorun.ep","malware analysis","sandbox report","threat intelligence","541b3e954a3dc2b5fd498a13426b3c4fb863943794040eacb6d384bc881ac833"],"about":{"@type":"SoftwareApplication","name":"541b3e954a3dc2b5fd498a13426b3c4fb863943794040eacb6d384bc881ac833","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"541b3e954a3dc2b5fd498a13426b3c4fb863943794040eacb6d384bc881ac833","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"Worm/Autorun.ep","antivirusDetections":{"malicious":1,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tac9,Found reference to API "Unlinking the file directly..." (Indicator: "link"; Source: "sample.bin"), Found reference to API "Unlinking the file directly..." (Indicator: "unlink"; Source: "sample.bin"), Found reference to API "Local administrator accounts get full rights over the network, which is used by worms to spread." (Indicator: "read"; Source: "sample.bin"), Found reference to API "b__0" (Indicator: "select"; Source: "sample.bin"), Found reference to API "d__70" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "LC_TIME" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Lets other computers change this PC's registry. It is normally off already." (Indicator: "read"; Source: "sample.bin"), Found reference to API "b__127_20" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "NortonSecurity" (Indicator: "security"; Source: "sample.bin"), Found reference to API "{0} connection(s)" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "b__0" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "b__0" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "SeShutdownPrivilege" (Indicator: "shutdown"; Source: "sample.bin"), file/memory contains long string with (Indicator: "open"; Source: "sample.bin"), file/memory contains long string with (Indicator: "security"; Source: "sample.bin"), Found reference to API "\\{}\pipe\{}-{}-{}-" (Indicator: "pipe"; Source: "sample.bin"), Found reference to API "b__35_0" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "b__35_1" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "b__35_2" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "b__35_3" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "b__1" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "b__0" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "Select a folder" (Indicator: "select"; Source: "sample.bin"), Found reference to API "OpenSCManager failed - %s " (Indicator: "open"; Source: "sample.bin"), Found reference to API "b__2" (Indicator: "select"; Source: "sample.bin"), Found reference to API "-s -accepteula -nobanner cmd.exe /c "takeown /f "" (Indicator: "accept"; Source: "sample.bin"), Found reference to API " Error reading public key from PsExec service: " (Indicator: "read"; Source: "sample.bin"), Found reference to API "failed to write secure " (Indicator: "write"; Source: "sample.bin")28:Tae0,"Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" in Source: sample.bin, "Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: sample.bin, "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: sample.bin, "SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: sample.bin, "SOFTWARE\Policies\Microsoft\WindowsFirewall\" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: sample.bin, "Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin, "Software\Microsoft\windows nt\currentversion" in Source: sample.bin, "Software\Classes\" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: sample.bin, "Software\Sysinternals" in Source: sample.bin, "SOFTWARE\Policies\Microsoft\Windows\System" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" in Source: sample.bin, "Software\Policies\Microsoft\Windows\System" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Lsa" in Source: sample.bin, "Software\Sysinternals\%s" in Source: sample.bin, "Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\RunOnceEx" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin29:T542,file/memory contains long string with (Indicator: "password"; Source: "sample.bin"), Found string "Remote Desktop is a common target for password guessing from the internet. Turn it off if you do not use it." (Indicator: "password"; Source: "sample.bin"), Found string "Attackers on the same network can answer these requests and capture password hashes." (Indicator: "password"; Source: "sample.bin"), Found string "This account has a well-known name, is not protected by UAC and is a common target for password guessing." (Indicator: "password"; Source: "sample.bin"), Found string "Protects the process that holds your sign-in secrets from being read by other programs. Some old drivers and tools do not work with it." (Indicator: "secret"; Source: "sample.bin"), Found string "Password stealing tools can read your Windows password from memory." (Indicator: "password"; Source: "sample.bin"), Found string "Turn WDigest password caching off" (Indicator: "password"; Source: "sample.bin"), Found string "Attackers on the network can get the user names they need for password guessing." (Indicator: "password"; Source: "sample.bin"), Found string "Weak LM password hashes are stored" (Indicator: "password"; Source: "sample.bin"), Found string "Automatic sign-in stores your password in plain text" (Indicator: "password"; Source: "sample.bin")2a:T9d5,Found string "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" (Indicator: "software\microsoft\windows\currentversion\explorer\user shell folders"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" (Indicator: "software\microsoft\windows nt\currentversion\winlogon"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" (Indicator: "software\microsoft\windows nt\currentversion\image file execution options"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" (Indicator: "software\microsoft\windows nt\currentversion\winlogon"; in Source: "sample.bin"), Found string "Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\wow6432node\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" (Indicator: "software\microsoft\windows nt\currentversion\image file execution options"; in Source: "sample.bin"), Found string "SYSTEM\CurrentControlSet\Control\Lsa" (Indicator: "system\currentcontrolset\control\lsa"; in Source: "sample.bin"), Found string "Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\wow6432node\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\wow6432node\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\RunOnceEx" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\RunOnceEx" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\RunOnceEx" (Indicator: "software\microsoft\windows\currentversion\runonceex"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin")2b:T4b6,Found string "Sysinternals - www.sysinternals.com" (Indicator: "sysinternals"; Source: "sample.bin"), Found string "ril.Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b" (Indicator: "sysinternals"; Source: "sample.bin"), Found string "Sysinternals PsExec" (Indicator: "sysinternals"; Source: "sample.bin"), Found string "Sysinternals" (Indicator: "sysinternals"; Source: "sample.bin"), file/memory contains long string with (Indicator: "sysinternals"; Source: "sample.bin"), Found string "Sysinternals License" (Indicator: "sysinternals"; Source: "sample.bin"), Found string " POUR LES DOMMAGES.Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement " (Indicator: "sysinternals"; Source: "sample.bin"), Found string "me si Sysinternals connaissait ou devrait conna" (Indicator: "sysinternals"; Source: "sample.bin"), Found string "Deleted the file with SYSTEM privileges using Sysinternals PsExec" (Indicator: "sysinternals"; Source: "sample.bin"), Found string "Software\Sysinternals" (Indicator: "sysinternals"; Source: "sample.bin"), Found string "Software\Sysinternals\%s" (Indicator: "sysinternals"; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"541b3e954a3dc2b5fd498a13426b3c4fb863943794040eacb6d384bc881ac833","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1793671921767,"unified_at":"2026-11-03T02:12:01.767Z","metadata":{"hashes":{"sha256":"541b3e954a3dc2b5fd498a13426b3c4fb863943794040eacb6d384bc881ac833","sha1":"182ce2cb7e447169cf16052d363e744f4f7407b1","md5":"1d8c79bf2525b13b64af3edf6d86aaba"},"file_info":{"file_name":"541b3e954a3dc2b5fd498a13426b3c4fb863943794040eacb6d384bc881ac833","file_type":["peexe","64bits","assembly","executable"],"file_type_id":"64-bit .NET exe","file_size":5543424,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793671814000,"last_seen":1793671815000,"last_multi_scan":1793671815000}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":36},"sandbox_signatures":{"informative_count":38,"suspicious_count":7,"malicious_count":1,"total":46},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Worm/Autorun.ep","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Worm/Autorun.ep","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"malicious","value":"YARA signature match – RiskTool.PsExec"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","identifiers":[{"type":"suspicious","value":"Has the ability to infect usb drives"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify COM objects"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains reference to Sysinternals URL"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"suspicious","value":"References security-related Windows services"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Initial Access","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"malicious","category":"Pattern Matching","name":"YARA signature match – RiskTool.PsExec","description":"YARA signature RiskTool.PsExec matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1570","id":"yara-2","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature match for RMM tool activity (psexec) detected in file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1219","id":"yara-557","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SetServiceStatus\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetLastInputInfo\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"api.github.com\" (Indicator: \"github.com\"), \"github.com\" (Indicator: \"github.com\"), \"https://github.com/Multron-Community/MultronWcleaner-Database\" (Indicator: \"github.com\"), \"https://github.com/winball501\" (Indicator: \"github.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManager failed - %s\n\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"-s -accepteula -nobanner cmd.exe /c \"takeown /f \"\" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-174","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"WRSVC\" (Indicator: \"wrsvc\") in Source: sample.bin, \"avast! Antivirus\" (Indicator: \"antivirus\") in Source: sample.bin, \"AvastSvc\" (Indicator: \"avast\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$28","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"Sysinternals - www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-262","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\%s-%s-%d-stdout, Found string - \\\\.\\pipe\\%s-%s-%d-stderr, Found string - \\\\.\\pipe\\%s, Found string - \\\\.\\pipe\\%s-%s-%d-stdin","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-146","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"Updater.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\".ost\" (Indicator: \".ost\") in Source: sample.bin, \".pst\" (Indicator: \".pst\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1114.001","id":"string-179","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcher failed.\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"sample.bin\"), Found reference to API \"StartServiceCtrlDispatcher failed.\" (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"5__3\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"b__160_0\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"b__0\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"b__1\" (Indicator: \"\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$29","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"Found string \"' | Get-Disk).FriendlyName\"\" (Indicator: \"Get-Disk\"; Source: \"sample.bin\"), Found string \"-Command \"(Get-Partition -DriveLetter '\" (Indicator: \"Get-Partition\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-394","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"Found string \"NoLMHash\" (Indicator: \"lmhash\"; Source: \"sample.bin\"), Found string \"lmhash\" (Indicator: \"lmhash\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1003.002","id":"string-867","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Compressed and encrypted the file in quarantine with AES-256 ({0} \" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\LanmanServer\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\"), Found string \"e\\Device\\Srv2\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\"), Found string \"\\Device\\LanmanRedirector\\%s\\ipc$\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"gSeTcbPrivilege\" (Indicator: \"SeTcbPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeTimeZonePrivilege\" (Indicator: \"SeTimeZonePrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeUndockPrivilege\" (Indicator: \"SeUndockPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeChangeNotifyPrivilege\" (Indicator: \"SeChangeNotifyPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeIncreaseWorkingSetPrivilege\" (Indicator: \"SeIncreaseWorkingSetPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeTakeOwnershipPrivilege\" (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"Found registry location strings which can modify COM objects","description":"Observed string: \"software\\classes\\clsid\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1546.015","id":"string-344","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"References security-related Windows services","description":"\"wuauserv\" (Indicator: \"wuauserv\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1574.010","id":"string-43","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"b__175_0\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"b__1\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"b__0\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Set-ItemProperty -Path $k -Name PendingFileRenameOperations -Value ([string[]]$v) -Type MultiString\" (Indicator: \"Set-ItemProperty\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-367","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"api.github.com\", Pattern match: \"www.sysinternals.com\", Pattern match: \"api.viruskov.com/ws\", Heuristic match: \"github.com\", Pattern match: \"https://github.com/multron-community/multronwcleaner-database\", Heuristic match: \".mobi\", Pattern match: \"www.microsoft.com\", Pattern match: \"https://discord.gg/xxmqw3muar\", Pattern match: \"https://github.com/winball501\", Pattern match: \"https://www.patreon.com/cw/multron\", Heuristic match: \"\n*.st\", Pattern match: \"https://raw.githubusercontent.com/multron-community/multronwcleaner/beta/malware_scan_eula.md\", Heuristic match: \"\n*.sc\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\", Found HTTPS url \"https://discord.gg\", Found HTTPS url \"https://www.patreon.com\", Found HTTPS url \"https://raw.githubusercontent.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"https://raw.githubusercontent.com/Multron-Community/MultronWcleaner/beta/MALWARE_SCAN_EULA.md\" (Indicator: \"githubusercontent.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"api.github.com\" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \"github.com\" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \"https://github.com/Multron-Community/MultronWcleaner-Database\" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \"https://github.com/winball501\" (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set the WinRM service to manual\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"\nError reading public key from PsExec service:\n\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"\nError reading public key length from PsExec services:\n\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"\nError importing public key:\n\" (Indicator: \"public key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547.001","id":"string-410","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Has the ability to infect usb drives","description":"\"autorun.inf files on CDs, network drives and some USB devices can start programs automatically.\" (Indicator: \"autorun.inf\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1091","id":"string-175","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService failed - %s\n\" (Indicator: \"CreateService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-199","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$2b","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenService failed - %s\n\" (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService failed - %s\n\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-690","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\d+\\.\\d+(\\.\\d+)?; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"Found reference to API \"Set the WinRM service to manual\" (Indicator: \"winrm \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1133","id":"string-909","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains multiple references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions in file \"sample.bin\" : .vmdk, .zip, .rar, .raw, .aac, .apk, .jar, .rtf, .arw, .rw2, .asf, .avi, .jpg, .bak, .bat, .bmp, .sql, .svg, .key, .bz2, .qcow2, .pages, .tar, .m4a, .m4v, .tgz, .tiff, .tif, .sqlite, .cmd, .cr2, .aiff, .ldf, .xlsx, .txt, .log, .vhdx, .m2ts, .dmp, .dng, .doc, .mdf, .mid, .mkv, .mp3, .mp4, .mpg, .mov, .vdi, .vhd, .vob, .nef, .wav, .mpeg, .wma, .wmv, .backup, .3gp, .flv, .ods, .odt, .odp, .ogg, .pptx, .orf","origin":"sample.bin","id":"string-52","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious Worm/Autorun.ep Sample 541b3e954a3d… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 541b3e954a3d…. Malware family: Worm/Autorun.ep. Threat score 70/100. 1/25 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/541b3e954a3dc2b5fd498a13426b3c4fb863943794040eacb6d384bc881ac833"}],["$","meta","4",{"property":"og:title","content":"Suspicious Worm/Autorun.ep Sample 541b3e954a3d… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 541b3e954a3d…. Malware family: Worm/Autorun.ep. Threat score 70/100. 1/25 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/541b3e954a3dc2b5fd498a13426b3c4fb863943794040eacb6d384bc881ac833"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Worm/Autorun.ep Sample 541b3e954a3d… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 541b3e954a3d…. Malware family: Worm/Autorun.ep. Threat score 70/100. 1/25 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]