23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T408,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample 5a09f209d29c… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample 5a09f209d29c…. Threat score 0/100. 0/0 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5a09f209d29c06b0b86e54500fb69b0ac893180826cbc59a112ed33512a630be","keywords":["Clean","malware analysis","sandbox report","threat intelligence","5a09f209d29c06b0b86e54500fb69b0ac893180826cbc59a112ed33512a630be"],"about":{"@type":"SoftwareApplication","name":"UIUSrv.exe","applicationCategory":["peexe","executable"],"identifier":"5a09f209d29c06b0b86e54500fb69b0ac893180826cbc59a112ed33512a630be","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":0,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGRERERERERERERERERERABmZmZmZmZmZmZmZmZmZmYAf//////////////////3AG//////////////////9wBv//////////////////cAb//////////////////3AG//////////////////9wBv//////////////////cAb//////////////////3AG//////////////////9wBv//////////////////cAb//////////////////3AG//////////////////9wBv//////////////////cAb//////////////////4AG//////////////////+ABv//////////////////gAb//////////////////4AG//////////////////+ABv//////////////////gAaIiIiIiIiIiIiIiIiIiGAGZmZmZmZmZmZmZmZGZmZgBmZmZmZmZmZmZmZoZ+aXYAZo7u7u7u7u7u5m7m7mdmAGZmZmZmZmZmZmZmZmZmZgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAf///////////////w==25:T555,"UIUSrv.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")26:T127d,"UIUSrv.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002516) "UIUSrv.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002516)27:T406,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "UIUSrv.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "UIUSrv.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "UIUSrv.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "UIUSrv.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp")28:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002516.00000000.301517.03130000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002516.00000000.301517.03130000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002516.00000000.301517.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002516.00000000.301517.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002516.00000000.301517.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002516.00000000.301517.03130000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002516.00000000.301517.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002516.00000000.301517.03130000.00000004.mdmp")29:T598a,Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; File: "UIUSrv.exe") Found reference to API (Indicator: "QueryServiceStatus"; File: "UIUSrv.exe") Found reference to API (Indicator: "CreateServiceW"; File: "UIUSrv.exe") Found reference to API (Indicator: "OpenServiceW"; File: "UIUSrv.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "UIUSrv.exe") Found reference to API (Indicator: "DeleteService"; File: "UIUSrv.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "UIUSrv.exe") Found reference to API (Indicator: "CreateProcessAsUserA"; File: "UIUSrv.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "UIUSrv.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "UIUSrv.exe") Found reference to API (Indicator: "RegisterServiceCtrlHandlerW"; File: "UIUSrv.exe") Found reference to API (Indicator: "ControlService"; File: "UIUSrv.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "UIUSrv.exe") Found reference to API (Indicator: "SetServiceStatus"; File: "UIUSrv.exe") Found reference to API (Indicator: "DuplicateTokenEx"; File: "UIUSrv.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "UIUSrv.exe") Found reference to API (Indicator: "RegCloseKey"; File: "UIUSrv.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "UIUSrv.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "UIUSrv.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetCPInfo"; File: "UIUSrv.exe") Found reference to API (Indicator: "TlsFree"; File: "UIUSrv.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "UIUSrv.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "UIUSrv.exe") Found reference to API (Indicator: "SetHandleCount"; File: "UIUSrv.exe") Found reference to API (Indicator: "CreateEventW"; File: "UIUSrv.exe") Found reference to API (Indicator: "DecodePointer"; File: "UIUSrv.exe") Found reference to API (Indicator: "DebugBreak"; File: "UIUSrv.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "UIUSrv.exe") Found reference to API (Indicator: "ExitProcess"; File: "UIUSrv.exe") Found reference to API (Indicator: "ConnectNamedPipe"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "UIUSrv.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "UIUSrv.exe") Found reference to API (Indicator: "LocalAlloc"; File: "UIUSrv.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "UIUSrv.exe") Found reference to API (Indicator: "TerminateProcess"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "UIUSrv.exe") Found reference to API (Indicator: "CreateNamedPipeW"; File: "UIUSrv.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "UIUSrv.exe") Found reference to API (Indicator: "EncodePointer"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetTickCount"; File: "UIUSrv.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "UIUSrv.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "UIUSrv.exe") Found reference to API (Indicator: "CreateThread"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "UIUSrv.exe") Found reference to API (Indicator: "ReadFile"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetACP"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetOEMCP"; File: "UIUSrv.exe") Found reference to API (Indicator: "CloseHandle"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "UIUSrv.exe") Found reference to API (Indicator: "HeapCreate"; File: "UIUSrv.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "UIUSrv.exe") Found reference to API (Indicator: "LCMapStringW"; File: "UIUSrv.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "UIUSrv.exe") Found reference to API (Indicator: "WriteFile"; File: "UIUSrv.exe") Found reference to API (Indicator: "RtlUnwind"; File: "UIUSrv.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "UIUSrv.exe") Found reference to API (Indicator: "RaiseException"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "UIUSrv.exe") Found reference to API (Indicator: "ResetEvent"; File: "UIUSrv.exe") Found reference to API (Indicator: "lstrlenA"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "UIUSrv.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "UIUSrv.exe") Found reference to API (Indicator: "SetLastError"; File: "UIUSrv.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "UIUSrv.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "UIUSrv.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetLastError"; File: "UIUSrv.exe") Found reference to API (Indicator: "TlsAlloc"; File: "UIUSrv.exe") Found reference to API (Indicator: "HeapAlloc"; File: "UIUSrv.exe") Found reference to API (Indicator: "lstrlenW"; File: "UIUSrv.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "UIUSrv.exe") Found reference to API (Indicator: "SetEvent"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetFileType"; File: "UIUSrv.exe") Found reference to API (Indicator: "TlsGetValue"; File: "UIUSrv.exe") Found reference to API (Indicator: "TlsSetValue"; File: "UIUSrv.exe") Found reference to API (Indicator: "ExitThread"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetStdHandle"; File: "UIUSrv.exe") Found reference to API (Indicator: "LocalFree"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetProcAddress"; File: "UIUSrv.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "UIUSrv.exe") Found reference to API (Indicator: "HeapFree"; File: "UIUSrv.exe") Found reference to API (Indicator: "Sleep"; File: "UIUSrv.exe") Found reference to API (Indicator: "HeapSize"; File: "UIUSrv.exe") Found reference to API (Indicator: "DisconnectNamedPipe"; File: "UIUSrv.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "UIUSrv.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "UIUSrv.exe") Found reference to API (Indicator: "DestroyWindow"; File: "UIUSrv.exe") Found reference to API (Indicator: "LoadIconW"; File: "UIUSrv.exe") Found reference to API (Indicator: "LoadStringW"; File: "UIUSrv.exe") Found reference to API (Indicator: "wvsprintfW"; File: "UIUSrv.exe") Found reference to API (Indicator: "BeginPaint"; File: "UIUSrv.exe") Found reference to API (Indicator: "CharNextW"; File: "UIUSrv.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "UIUSrv.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "UIUSrv.exe") Found reference to API (Indicator: "LoadCursorW"; File: "UIUSrv.exe") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "UIUSrv.exe") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "UIUSrv.exe") Found reference to API (Indicator: "WTSEnumerateSessionsA"; File: "UIUSrv.exe") Found reference to API (Indicator: "WTSQueryUserToken"; File: "UIUSrv.exe") Found reference to API (Indicator: "WTSFreeMemory"; File: "UIUSrv.exe") Found reference to API (Indicator: "CoUninitialize"; File: "UIUSrv.exe") Found reference to API (Indicator: "CoInitialize"; File: "UIUSrv.exe") Found reference to API (Indicator: "FlsFree"; File: "UIUSrv.exe") Found reference to API (Indicator: "FlsSetValue"; File: "UIUSrv.exe") Found reference to API (Indicator: "FlsGetValue"; File: "UIUSrv.exe") Found reference to API (Indicator: "FlsAlloc"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "UIUSrv.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "UIUSrv.exe") Found reference to API (Indicator: "MessageBoxW"; File: "UIUSrv.exe") Found reference to API (Indicator: "SetServiceStatus"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "WTSQueryUserToken"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "WTSFreeMemory"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "WTSEnumerateSessionsA"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "DisconnectNamedPipe"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "wvsprintfW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserA"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "RegisterServiceCtrlHandlerW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002516.00000000.301517.00EA9000.00000002.mdmp")2a:T9d2,"UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "UIUSRV.EXE"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "UIUSrv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[],"files_deleted":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["ntdll.dll","userenv.dll","wow64cpu.dll","ucrtbase.dll","sspicli.dll","VxSSL32.dll","msvcrt.dll","usp10.dll","oleaut32.dll","fltLib.dll","rpcrt4.dll","lpk.dll","gdi32full.dll","combase.dll","ws2_32.dll","imm32.dll","kernel32.dll","wow64win.dll","shlwapi.dll","ole32.dll","user32.dll","msctf.dll","bcryptprimitives.dll","gdi32.dll","wtsapi32.dll","cryptsp.dll","wow64.dll","apphelp.dll","sechost.dll","profapi.dll","KernelBase.dll","win32u.dll","advapi32.dll","cryptbase.dll","msvcp_win.dll"],"processes":[{"command_line":"","icon":"$24","name":"UIUSrv.exe","normalized_path":"C:\\UIUSrv.exe","pid":3672,"ppid":0,"sha256":"5a09f209d29c06b0b86e54500fb69b0ac893180826cbc59a112ed33512a630be","uid":"00047927-00003672"}],"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"}]},"registry_activity":{"keys_created":[],"keys_deleted":[],"keys_modified":[]},"sandbox_reports":[{"analysis_start_time":"2026-01-01T09:45:24+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"695642333096f754120f5b60","indicators_count":{"informative":90,"malicious":0,"suspicious":2},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"UIUSrv.exe","verdict":"clean"},{"analysis_start_time":"2018-05-01T22:14:43+00:00","environment_description":"Windows 7 32 bit","environment_id":100,"id":"5ae8ca9f7ca3e114c242b25c","indicators_count":{"informative":7,"malicious":0,"suspicious":6},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"UIUSrv.exe","verdict":"clean"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":0,"files_deleted_count":0,"files_written_count":1,"http_requests_count":0,"imported_dlls_count":35,"injected_processes_count":0,"mutex_created_count":0,"process_count":1,"registry_keys_created_count":0,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"script_calls_count":0,"spawned_processes_count":1}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{},"av_detections":{"engines":{}},"incidents":[{"details":[{"detail":"Reads the active computer name"}],"details_count":1,"name":"Fingerprint","sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Connections Discovery"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Create Process with Token"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes on remote desktop session hosts"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls APIs used for Remove Service"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Remote Desktop Protocol"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"}],"rule_matches":{},"sandbox_signatures":[{"category":"Anti-Reverse Engineering","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"UIUSrv.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"UIUSrv.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"UIUSrv.exe\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 29038-529-004042AB\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 29038-529-004042AB","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"SOFTWARE\\Conexant\" in Source: UIUSrv.exe\n \"SYSTEM\\CurrentControlSet\\Services\\%s\" in Source: UIUSrv.exe\n \"SYSTEM\\CurrentControlSet\\Services\\%s\" in Source: 00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\n \"SOFTWARE\\Conexant\" in Source: 00000000-00002516.00000000.301517.00EA9000.00000002.mdmp","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"DuplicateToken\" which can \"create a new access token that duplicates one already in existence\" [Source: UIUSrv.exe]\n Observed import api \"DuplicateTokenEx\" which can \"create a new access token that duplicates an existing token\" [Source: UIUSrv.exe]\n Observed import api \"InitializeSecurityDescriptor\" which can \"initialize a new security descriptor\" [Source: UIUSrv.exe]\n Observed import api \"SetSecurityDescriptorDacl\" which can \"set information in a discretionary access control list (DACL)\" [Source: UIUSrv.exe]","id":"static-87","level":"informative","mitre_attack_id":"T1134.001","name":"Imports system security related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"E:\\UIU\\AUDDA-1299\\Universal_Installer_Uninstaller-COMCA\\UIUService\\Release\\UIUService.pdb\"","id":"string-7","level":"informative","name":"Contains PDB pathways","origin":"File/Memory","relevance":1,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"},{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"UIUSrv.exe\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-544","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to open a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" has an writable section named \".data\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"UIUSrv.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$25","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002516)\n \"UIUSrv.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002516)\n \"UIUSrv.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002516)\n \"UIUSrv.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002516)","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"External Systems","description":"0/66 Antivirus vendors marked sample as malicious (0% detection rate)\n 0/14 Antivirus vendors marked sample as malicious (0% detection rate)","id":"avtest-1","level":"informative","name":"Sample was identified as clean by Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"UIUSrv.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002516.00000000.301517.03130000.00000004.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"UIUSrv.exe\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"UIUSrv.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"UIUSrv.exe\" trying to access non-existent file \"C:\\WTSAPI32.DLL\"\n \"UIUSrv.exe\" trying to access non-existent file \"C:\\USERENV.DLL\"\n \"UIUSrv.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"UIUSrv.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"UIUSrv.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found XOR loop in file \"sample.bin\" at offset 102403; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 27189; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 27808; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 102364; code bytes = 8030","id":"binary-92","level":"informative","mitre_attack_id":"T1027.005","name":"XOR operations in executable file detected","origin":"Binary File","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"UIUSrv.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"QueryServiceStatus\" (File: \"UIUSrv.exe\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-910","level":"informative","mitre_attack_id":"T1007","name":"Able to query service configuration on system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"UIUSrv.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"UIUSrv.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Network Related","description":"\"1.0.0.0\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"$26","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"Found string - \\\\.\\pipe\\UIUChannel","id":"string-146","level":"informative","mitre_attack_id":"T1559","name":"Found named pipe like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"UIUSrv.exe\" queries basic process information of the \"C:\\UIUSrv.exe\" (UID: 2516)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; File: \"UIUSrv.exe\")\n Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-117","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to enumerate logon sessions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"UIUSrv.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed process enumerate api used in \"wtsapi32.dll\" [Source: UIUSrv.exe]","id":"static-209","level":"suspicious","mitre_attack_id":"T1057","name":"Contains ability to enumerate processes on remote desktop session hosts","origin":"Static Parser","relevance":3,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"ControlService@ADVAPI32.DLL at 00047927-00003672-52824-66-00C11F60","id":"stream-14","level":"suspicious","name":"Contains ability to open/control a service","origin":"Hybrid Analysis Technology","relevance":8,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"UIUSrv.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002516)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"UIUSrv.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"UIUSrv.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-191","level":"informative","mitre_attack_id":"T1007","name":"Able to enumerate service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"SOFTWARE\\Conexant\" in Source: 00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\n \"SYSTEM\\CurrentControlSet\\Services\\%s\" in Source: 00000000-00002516.00000000.301517.00EA9000.00000002.mdmp","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; File: \"UIUSrv.exe\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"UIUSrv.exe\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-199","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"UIUSrv.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"UIUSrv.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"UIUSrv.exe\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002516.00000000.301517.03130000.00000004.mdmp\")","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"System Security","description":"$27","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"SetSecurityDescriptorDacl\n RegCloseKey\n CreateProcessAsUserA\n RegOpenKeyExW\n StartServiceCtrlDispatcherW\n RegOpenKeyExA\n CreateServiceW\n OutputDebugStringW\n GetModuleFileNameW\n IsDebuggerPresent\n GetCommandLineW\n UnhandledExceptionFilter\n GetStartupInfoW\n GetProcAddress\n CreateThread\n LoadLibraryW\n DisconnectNamedPipe\n WriteFile\n ExitThread\n GetModuleHandleW\n TerminateProcess\n ConnectNamedPipe\n Sleep\n GetTickCount","id":"static-1","level":"suspicious","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"},{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found string \"DeleteService\" (File: \"UIUSrv.exe\")\n Found string \"DeleteService\" (Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-690","level":"informative","mitre_attack_id":"T1543.003","name":"Able to unregister service from Service Control Manager","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"UIUSrv.exe\" queried SystemProcessInformation at 00000000-00002516-00000C15-3711499611 [PID: 2516]\n \"UIUSrv.exe\" queried SystemProcessInformation at 00000000-00002516-00000C15-3711507563 [PID: 2516]","id":"api-9","level":"informative","mitre_attack_id":"T1057","name":"Queries process information","origin":"API Call","relevance":4,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; File: \"UIUSrv.exe\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"UIUSrv.exe\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-906","level":"informative","mitre_attack_id":"T1057","name":"Able to list processes on remote desktop session host","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" file has an entrypoint instructions - \"call\t0x403d3f,jmp\t0x402394,mov\tedi, edi,push\tebp,mov\tebp, esp,pop\tebp,jmp\t0x402551,cmp\tecx, dword ptr [0x40d070],jne\t0x402520,repz ret\t,jmp\t0x403dda,mov\tedi, edi,push\tebp,mov\tebp, esp,pop\tebp,jmp\t0x403f2f,mov\tedi, edi,push\tebp,mov\tebp, esp,push\t0xa,push\t0,push\tdword ptr [ebp + 8],call\t0x404171,add\tesp, 0xc,pop\tebp,ret\t,mov\tedi, edi,push\tebp,mov\tebp, esp,pop\tebp,jmp\t0x402530,mov\tedi, edi,push\tebp,mov\tebp, esp,cmp\tdword ptr [ebp + 8], 0,je\t0x402589,push\tdword ptr [ebp + 8],push\t0,\"","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found registry query API: \"RegOpenKeyExW\" in file \"UIUSrv.exe\"\n Found registry query API: \"RegOpenKeyExA\" in file \"UIUSrv.exe\"\n Found registry query API: \"RegQueryValueExA\" in file \"UIUSrv.exe\"\n Found registry query API: \"RegQueryValueExA\" in \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExA\" in \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\"","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: UIUSrv.exe]","id":"static-188","level":"informative","mitre_attack_id":"T1489","name":"Calls APIs used for Remove Service","origin":"Static Parser","relevance":5,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Network Related","description":"Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"","id":"string-3","level":"informative","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":10,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"},{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; File: \"UIUSrv.exe\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; File: \"UIUSrv.exe\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-209","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to start a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"UIUSrv.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002516)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74FE0000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$28","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"UIUSrv.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"UIUSrv.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"UIUSrv.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcess\"; File: \"UIUSrv.exe\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"$29","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"UIUSrv.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","id":"static-18","level":"informative","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"},{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"UIUSrv.exe\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; File: \"UIUSrv.exe\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"UIUSrv.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"UIUSrv.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"UIUSrv.exe\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-192","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to modify system service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found string \"FlsSetValue\" (Source: UIUSrv.exe.bin, API is part of module: KERNELBASE.DLL)\n Found string \"FlsGetValue\" (Source: UIUSrv.exe.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetProcessWindowStation\" (Source: UIUSrv.exe.bin, API is part of module: USER32.DLL)\n Found string \"GetUserObjectInformationW\" (Source: UIUSrv.exe.bin, API is part of module: USER32.DLL)\n Found string \"GetLastActivePopup\" (Source: UIUSrv.exe.bin, API is part of module: USER32.DLL)\n Found string \"GetActiveWindow\" (Source: UIUSrv.exe.bin, API is part of module: USER32.DLL)\n Found string \"MessageBoxW\" (Source: UIUSrv.exe.bin, API is part of module: USER32.DLL)","id":"string-64","level":"suspicious","name":"Input file contains API references not part of its Import Address Table (IAT)","origin":"File/Memory","relevance":10,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"},{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"UIUSrv.exe\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"UIUSrv.exe\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\"","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"UIUSrv.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"UIUSrv.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2a","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"UIUSrv.exe\")","id":"string-436","level":"informative","mitre_attack_id":"T1021.001","name":"Contains ability to perform remote desktop activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; File: \"UIUSrv.exe\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"UIUSrv.exe\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-546","level":"informative","mitre_attack_id":"T1018","name":"Contains ability to retrieve remote session information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"UIUSrv.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"UIUSrv.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 77030000\n \"UIUSrv.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 77030000\n \"UIUSrv.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 77030000\n \"UIUSrv.exe\" loaded module \"KERNEL32\" at base 76ed0000\n \"UIUSrv.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72d30000\n \"UIUSrv.exe\" loaded module \"RPCRT4.DLL\" at base 74fe0000","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcessAsUser\"; File: \"UIUSrv.exe\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"UIUSrv.exe\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-168","level":"informative","mitre_attack_id":"T1134.002","name":"Contains ability to create process with token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00047927-00003672-52824-118-00C13D3F","id":"stream-2","level":"informative","name":"Contains ability to query machine time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"}]},{"category":"System Security","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00047927-00003672-52824-179-00C11A10","id":"stream-44","level":"suspicious","name":"Contains ability to elevate privileges","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"CreateProcessAsUserA@ADVAPI32.DLL at 00047927-00003672-52824-180-00C12250","id":"stream-42","level":"suspicious","name":"Possibly tries to hide a process launching it with different user credentials","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"UIUSrv.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"UIUSrv.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002516)","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"UIUSrv.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"UIUSrv.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"UIUSrv.exe\" trying to touch file \"C:\\UIUSrv.exe\"\n \"UIUSrv.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"UIUSrv.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"UIUSrv.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"UIUSrv.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"UIUSrv.exe\" trying to touch file \"C:\\WTSAPI32.DLL\"\n \"UIUSrv.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\wtsapi32.dll\"\n \"UIUSrv.exe\" trying to touch file \"C:\\USERENV.DLL\"\n \"UIUSrv.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\userenv.dll\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"CreateNamedPipeW@KERNEL32.DLL at 00047927-00003672-52824-179-00C11A10","id":"stream-45","level":"informative","name":"Contains ability to create named pipes for inter-process communication (IPC)","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-930","level":"informative","mitre_attack_id":"T1059.003","name":"Able to retrieve command line parameters of the running process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"UIUSrv.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"\"UIUSrv.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76FD0000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"UIUSrv.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00047927-00003672-52824-12-00C12516\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00047927-00003672-52824-33-00C14CE2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00047927-00003672-52824-338-00C129AB","id":"stream-4","level":"informative","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"suspicious","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"5ae8ca9f7ca3e114c242b25c","report_type":"sandbox"},{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"UIUSrv.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-242","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to close a handle to a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"UIUSrv.exe\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"UIUSrv.exe\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002516.00000000.301517.00EA9000.00000002.mdmp\")","id":"string-210","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create/connect to a named pipe (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"695642333096f754120f5b60","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":0,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"mitre_attacks":{"total":41},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":92,"malicious_count":0,"suspicious_count":7,"total":99}},"summary":{"score":0,"tags":null,"verdict":"clean"}},"metadata":{"file_info":{"file_name":"UIUSrv.exe","file_size":105984,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"041bc32fce7a7311fa4c35bef4794005","md5":"fdfcc6e62636410d25a7063600af8788","sha1":"9d746e60fe7cbcdf4f4ca56f9dee0cf47914a820","sha256":"5a09f209d29c06b0b86e54500fb69b0ac893180826cbc59a112ed33512a630be","sha512":"5a311ca15daf8fb618f289d5f04d6531da164bc40d84ea00983ff04ea710babb04d01442855c10121af79a611a15432a9e018ff650dd694fb121da60e13eb030","ssdeep":"1536:0i/K7l5nv09d136oSL+oxoGmEKEPpXQb:vC7lRW1joxoGmEKEPpXQb","ssdeep_chunks":["1536:0i/K7l5","1536:i/K7l5n","1536:/K7l5nv","1536:K7l5nv0","1536:7l5nv09","1536:l5nv09d","1536:5nv09d1","1536:nv09d13","1536:v09d136","1536:09d136o","1536:9d136oS","1536:d136oSL","1536:136oSL+","1536:36oSL+o","1536:6oSL+ox","1536:oSL+oxo","1536:SL+oxoG","1536:L+oxoGm","1536:+oxoGmE","1536:oxoGmEK","1536:xoGmEKE","1536:oGmEKEP","1536:GmEKEPp","1536:mEKEPpX","1536:EKEPpXQ","1536:KEPpXQb","3072:0i/K7l5","3072:i/K7l5n","3072:/K7l5nv","3072:K7l5nv0","3072:7l5nv09","3072:l5nv09d","3072:5nv09d1","3072:nv09d13","3072:v09d136","3072:09d136o","3072:9d136oS","3072:d136oSL","3072:136oSL+","3072:36oSL+o","3072:6oSL+ox","3072:oSL+oxo","3072:SL+oxoG","3072:L+oxoGm","3072:+oxoGmE","3072:oxoGmEK","3072:xoGmEKE","3072:oGmEKEP","3072:GmEKEPp","3072:mEKEPpX","3072:EKEPpXQ","3072:KEPpXQb","1536:vC7lRW1","1536:C7lRW1j","1536:7lRW1jo","1536:lRW1jox","1536:RW1joxo","1536:W1joxoG","1536:1joxoGm","1536:joxoGmE"]},"submissions":{"first_seen":1525205664000,"last_multi_scan":1767260724000,"last_seen":1767260724000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["695642333096f754120f5b60","5ae8ca9f7ca3e114c242b25c"]},"schema_version":"1.0.9","sha256":"5a09f209d29c06b0b86e54500fb69b0ac893180826cbc59a112ed33512a630be","threat_score":0,"unified_at":"2026-09-18T13:11:02.442Z","unified_at_epoch_ms":1789737062442,"verdict":"clean"}}]]}] 1d:null 21:[["$","title","0",{"children":"Clean Sample 5a09f209d29c… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample 5a09f209d29c…. Threat score 0/100. 0/0 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5a09f209d29c06b0b86e54500fb69b0ac893180826cbc59a112ed33512a630be"}],["$","meta","4",{"property":"og:title","content":"Clean Sample 5a09f209d29c… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample 5a09f209d29c…. Threat score 0/100. 0/0 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5a09f209d29c06b0b86e54500fb69b0ac893180826cbc59a112ed33512a630be"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample 5a09f209d29c… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample 5a09f209d29c…. Threat score 0/100. 0/0 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]