26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 83:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSIL.PowerShell.gen Sample 59afd76ba4c6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 59afd76ba4c6…. Malware family: Trojan.MSIL.PowerShell.gen. Threat score 100/100. 2/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273","keywords":["Malicious","Trojan.MSIL.PowerShell.gen","malware analysis","sandbox report","threat intelligence","59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273"],"about":{"@type":"SoftwareApplication","name":"59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin","applicationCategory":["compressed","innosetup"],"identifier":"59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MSIL.PowerShell.gen","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1c34,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.7221D000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.7221D000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.7221D000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005516.00000002.315698.01001000.00000002.mdmp")28:T1062,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp")29:T1473,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") file/memory contains long string with (Indicator: "SetTimer"; File: "unins000.dat") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.01001000.00000002.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.01001000.00000002.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.01001000.00000002.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005516.00000002.315698.01001000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005516.00000002.315698.01001000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00006336.00000000.311696.00514000.00000004.mdmp")2a:T43b,Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.7221D000.00000004.mdmp")2b:Teb0,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.7221D000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.7221D000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.7221D000.00000004.mdmp")2c:T595,Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp, 00000000-00005516.00000000.311857.04E90000.00000040.mdmp, 00000000-00005516.00000000.311857.056D0000.00000004.mdmp, 00000000-00005516.00000000.311857.059C0000.00000040.mdmp, 00000000-00005516.00000001.313778.00EB2000.00000040.mdmp, 00000000-00005516.00000001.313778.04F20000.00000040.mdmp, 00000000-00005516.00000001.313778.05510000.00000004.mdmp, 00000000-00005516.00000001.313778.05900000.00000004.mdmp, 00000000-00005516.00000001.313778.059C0000.00000040.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp, 00000000-00005516.00000002.315698.04E40000.00000040.mdmp, 00000000-00005516.00000002.315698.04F20000.00000040.mdmp, 00000000-00005516.00000002.315698.05330000.00000040.mdmp, 00000000-00005516.00000002.315698.05390000.00000040.mdmp, 00000000-00005516.00000002.315698.05960000.00000004.mdmp, 00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00005516.00000002.315698.7221D000.00000004.mdmp")2d:T61a,Found PE header "MZ" - Source: "00000000-00005516.00000000.311857.04E40000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000000.311857.04E90000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000000.311857.056D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000000.311857.059C0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000001.313778.00EB2000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000001.313778.04F20000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000001.313778.05510000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000001.313778.05900000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000001.313778.059C0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000002.315698.00EB2000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000002.315698.04E40000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000002.315698.04F20000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000002.315698.05330000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000002.315698.05390000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000002.315698.05960000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005516.00000002.315698.059C0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006336.00000000.311696.0051C000.00000002.mdmp")2e:T405,Found string - \\.\DISPLAY1; Source: "00000000-00005516.00000002.315698.00E70000.00000004.mdmp, 00000000-00005516.00000002.315698.00EB2000.00000040.mdmp") Found string - \.\DISPLAY1; Source: "00000000-00005516.00000002.315698.00F07000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00005516.00000002.315698.00F07000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00005516.00000002.315698.00F07000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00005516.00000002.315698.00F07000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00005516.00000002.315698.00F07000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00005516.00000002.315698.00F07000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00005516.00000002.315698.00F07000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00005516.00000002.315698.00F07000.00000004.mdmp") Found string - \\.\DK; Source: "00000000-00005516.00000002.315698.06990000.00000004.mdmp")2f:T990,"\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00006336.00000000.311696.00507000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/>\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00006336.00000000.311696.00507000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a3f4be95689946df50b43c5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a3f4be95689946df50b43c5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2d","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a3f4be95689946df50b43c5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a3f4be95689946df50b43c5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a3f4be95689946df50b43c5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$30","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a3f4be95689946df50b43c5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"