23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 5c095d6ea673… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5c095d6ea673…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 12 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c"],"about":{"@type":"SoftwareApplication","name":"7jh4wqd.exe","applicationCategory":["peexe","executable"],"identifier":"5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T5f7,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")25:T554,"" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")26:T473,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")27:T4cc,"Z:\5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\CabA648.tmp" for deletion "Z:\5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\TarA659.tmp" for deletion "Z:\5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\CabA919.tmp" for deletion "Z:\5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\TarA91A.tmp" for deletion "Z:\5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\CabE132.tmp" for deletion "Z:\5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\TarE133.tmp" for deletion "Z:\5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S9Y0GKU4\221_132_35_56[1].txt" for deletion28:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790265716097,"unified_at":"2026-09-24T16:01:56.097Z","metadata":{"hashes":{"sha256":"5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c","sha1":"34dec901004dabbdab4bd41a19fa0960503a5c61","md5":"a5c52bd47f7fdfd54a2584a669eabe59","sha512":"67395c295b1b31afa545992cca5a97c42282b1e62c612c58484ee4ece93edf2716b0fc4780aea6c2d20079d7954e0e82b17a88edd461be90591276d1fbd2b880","ssdeep":"1536:AlZabTYWBNYI6zfULayfABbQHCyxRKBbOTKvNgV2iHV5wbQs2sMJxEgRjZd+9/:Af0NBwUqcis1TKvNgV7G0seJx1Rj3O/","ssdeep_chunks":["1536:AlZabTY","1536:lZabTYW","1536:ZabTYWB","1536:abTYWBN","1536:bTYWBNY","1536:TYWBNYI","1536:YWBNYI6","1536:WBNYI6z","1536:BNYI6zf","1536:NYI6zfU","1536:YI6zfUL","1536:I6zfULa","1536:6zfULay","1536:zfULayf","1536:fULayfA","1536:ULayfAB","1536:LayfABb","1536:ayfABbQ","1536:yfABbQH","1536:fABbQHC","1536:ABbQHCy","1536:BbQHCyx","1536:bQHCyxR","1536:QHCyxRK","1536:HCyxRKB","1536:CyxRKBb","1536:yxRKBbO","1536:xRKBbOT","1536:RKBbOTK","1536:KBbOTKv","1536:BbOTKvN","1536:bOTKvNg","1536:OTKvNgV","1536:TKvNgV2","1536:KvNgV2i","1536:vNgV2iH","1536:NgV2iHV","1536:gV2iHV5","1536:V2iHV5w","1536:2iHV5wb","1536:iHV5wbQ","1536:HV5wbQs","1536:V5wbQs2","1536:5wbQs2s","1536:wbQs2sM","1536:bQs2sMJ","1536:Qs2sMJx","1536:s2sMJxE","1536:2sMJxEg","1536:sMJxEgR","1536:MJxEgRj","1536:JxEgRjZ","1536:xEgRjZd","1536:EgRjZd+","1536:gRjZd+9","1536:RjZd+9/","3072:AlZabTY","3072:lZabTYW","3072:ZabTYWB","3072:abTYWBN","3072:bTYWBNY","3072:TYWBNYI","3072:YWBNYI6","3072:WBNYI6z","3072:BNYI6zf","3072:NYI6zfU","3072:YI6zfUL","3072:I6zfULa","3072:6zfULay","3072:zfULayf","3072:fULayfA","3072:ULayfAB","3072:LayfABb","3072:ayfABbQ","3072:yfABbQH","3072:fABbQHC","3072:ABbQHCy","3072:BbQHCyx","3072:bQHCyxR","3072:QHCyxRK","3072:HCyxRKB","3072:CyxRKBb","3072:yxRKBbO","3072:xRKBbOT","3072:RKBbOTK","3072:KBbOTKv","3072:BbOTKvN","3072:bOTKvNg","3072:OTKvNgV","3072:TKvNgV2","3072:KvNgV2i","3072:vNgV2iH","3072:NgV2iHV","3072:gV2iHV5","3072:V2iHV5w","3072:2iHV5wb","3072:iHV5wbQ","3072:HV5wbQs","3072:V5wbQs2","3072:5wbQs2s","3072:wbQs2sM","3072:bQs2sMJ","3072:Qs2sMJx","3072:s2sMJxE","3072:2sMJxEg","3072:sMJxEgR","3072:MJxEgRj","3072:JxEgRjZ","3072:xEgRjZd","3072:EgRjZd+","3072:gRjZd+9","3072:RjZd+9/","1536:Af0NBwU","1536:f0NBwUq","1536:0NBwUqc","1536:NBwUqci","1536:BwUqcis","1536:wUqcis1","1536:Uqcis1T","1536:qcis1TK","1536:cis1TKv","1536:is1TKvN","1536:s1TKvNg","1536:1TKvNgV","1536:TKvNgV7","1536:KvNgV7G","1536:vNgV7G0","1536:NgV7G0s","1536:gV7G0se","1536:V7G0seJ","1536:7G0seJx","1536:G0seJx1","1536:0seJx1R","1536:seJx1Rj","1536:eJx1Rj3","1536:Jx1Rj3O","1536:x1Rj3O/"],"imphash":"3dcb77f944d10503a307f5a96d569cd9"},"file_info":{"file_name":"7jh4wqd.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":157696,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297207000,"last_seen":1677367620000,"last_multi_scan":1677367620000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":22,"malicious_count":12,"total":44},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.tnft","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.309441","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2837303","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Dridex.IOSI-3509","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2837303 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.P trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Backdoor/Dridex.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004beaac1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Agent.czlu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.dyjyoc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-HY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_DYRE.YYSOY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_DYRE.YYSOY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zyx.APS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Adware.BrowseFox.Win32.138503","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"221.132.35.56:8843\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"IESQMMUTEX_0_208\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"NTMARTA.DLL\" at base 743C0000\n \"\" loaded module \"KERNEL32.DLL\" at base 76150000\n \"\" loaded module \"CRYPTSP.DLL\" at base 74B30000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\RSAENH.DLL\" at base 74AF0000\n \"\" loaded module \"ADVAPI32.DLL\" at base 751F0000\n \"\" loaded module \"CRYPTBASE.DLL\" at base 74FA0000\n \"\" loaded module \"NORMALIZ.DLL\" at base 751E0000\n \"\" loaded module \"CRYPT32.DLL\" at base 769C0000\n \"\" loaded module \"USERENV.DLL\" at base 74C30000\n \"\" loaded module \"API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL\" at base 76500000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"AddMandatoryAce@ADVAPI32.dll\"\n \"GetMartaExtensionInterface@ntmarta.dll\"\n \"RtlMoveMemory@ntdll.dll\"\n \"CryptAcquireContextW@ADVAPI32.dll\"\n \"CryptAcquireContextW@CRYPTSP.dll\"\n \"CPAcquireContext@rsaenh.dll\"\n \"CPReleaseContext@rsaenh.dll\"\n \"CPGenKey@rsaenh.dll\"\n \"CPDeriveKey@rsaenh.dll\"\n \"CPDestroyKey@rsaenh.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00153968-00001632-774801AA-170830","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"SCHEDLGU.TXT\" has type \"Little-endian UTF-16 Unicode text, with CRLF, CR line terminators\"\n \"setupact.log\" has type \"ASCII text, with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceA@SECHOST.DLL at 00153968-00001632-774801AA-170285\n OpenServiceA@SECHOST.DLL at 00153968-00001632-774801AA-170286\n OpenServiceW@SECHOST.DLL at 00153968-00001632-774801AA-176906","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00153968-00001632-7746FDA0-164674","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00153968-00001632-774801AA-169882","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00153968-00001632-774801AA-163080\n RasPortListen@RASMAN.DLL at 00153968-00001632-774801AA-169539","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$24","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 204806 does not match actual CRC 158533","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n LoadLibraryExA\n MapViewOfFileEx\n WriteProcessMemory","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"PE claims program is from Wed Sep 25 09:09:22 1991","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLEFILETRACING\", Value: \"00000000\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLECONSOLETRACING\", Value: \"00000000\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"FILETRACINGMASK\", Value: \"0000FFFF\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"CONSOLETRACINGMASK\", Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries/modifies the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$25","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/55 Antivirus vendors marked sample as malicious (9% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 221.132.35.56 on port 8843","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$26","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint points to uncommon section","description":".text0","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabA648.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarA659.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabA919.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarA91A.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabE132.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarE133.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Explorer.EXE\" (UID: 00235250-00001496)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00151953-00003864-7748228D-237735","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00151953-00003864-7748228D-233126\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00151953-00003864-50360-205-01006860","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$27","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabA648.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarA659.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabA919.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarA91A.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabE132.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarE133.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\221_132_35_56[1].txt\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x0EE10000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x0EE11000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x0EE0D000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x0EE0F000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x0EE0E000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x0EE09000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x0EE08000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x0EE0B000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x0EE0A000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x0EE05000\"","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 51 instructions to foreign process \"Explorer.EXE\" (UID: 00235250-00001496)\n Wrote 379 instructions to foreign process \"Explorer.EXE\" (UID: 00235250-00001496)\n Wrote 357 instructions to foreign process \"Explorer.EXE\" (UID: 00235250-00001496)\n Wrote 100 instructions to foreign process \"Explorer.EXE\" (UID: 00235250-00001496)\n Wrote 404 instructions to foreign process \"Explorer.EXE\" (UID: 00235250-00001496)\n Wrote 303 instructions to foreign process \"Explorer.EXE\" (UID: 00235250-00001496)\n Wrote 229 instructions to foreign process \"Explorer.EXE\" (UID: 00235250-00001496)","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00005012 bytes of memory in \"explorer.exe\" (Protection: \"execute/read/write\")\n \"\" allocated 00466944 bytes of memory in \"explorer.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00235250-00001496)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 466944 bytes to a foreign process \"explorer.exe\" (PID: 00001496)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00151953-00003864-7748228D-174922\n NtQueryInformationProcess@NTDLL.DLL at 00151953-00003864-7748228D-233328\n NtQueryVirtualMemory@NTDLL.DLL at 00151953-00003864-7748228D-237719","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"level":"informative","category":"General","name":"Reads System Certificates Settings","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA\", Key: \"BLOB\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\", Key: \"BLOB\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\", Key: \"BLOB\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\", Key: \"BLOB\")","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\", Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Contains ability to listen for incoming connections"},{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":27,"imported_dlls_count":219,"dropped_files_count":0,"extracted_files_count":17,"files_written_count":42,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"563359120e316d6c5771428b","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Artemis","contacted_countries":["VNM"],"submit_name":"7jh4wqd.exe","analysis_start_time":"2015-10-30T06:48:51+00:00","indicators_count":{"informative":6,"suspicious":19,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"563339740e316d892e54120e","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"Dridex.M","contacted_countries":["VNM"],"submit_name":"7jh4wqd.exe","analysis_start_time":"2015-10-30T04:35:09+00:00","indicators_count":{"informative":7,"suspicious":25,"malicious":9},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"563339740e316d892e54120c","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"Dridex.M","contacted_countries":["VNM"],"submit_name":"7jh4wqd.exe","analysis_start_time":"2015-10-30T04:34:40+00:00","indicators_count":{"informative":8,"suspicious":29,"malicious":14},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"221.132.35.56","port":8843,"protocol":"TCP","country":"Viet Nam","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]}],"dns_resolutions":null,"http_requests":[{"host":"","host_ip":"192.168.56.14:49160","url":"","method":"","response_code":"304","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}],"processes":[{"pid":2548,"ppid":0,"name":"5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c.exe","command_line":"","normalized_path":"","uid":"00007846-00002548","icon":"$28"},{"pid":1508,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00011660-00001508"},{"pid":1480,"ppid":0,"name":"taskhost.exe","command_line":"","normalized_path":"","uid":"00017264-00001480"},{"pid":1468,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00011660-00001468"}],"all_imported_dlls":["MSASN1.dll","sensapi.dll","CRYPTBASE.dll","wship6.dll","MSCTF.dll","pnrpnsp.dll","bcryptprimitives.dll","OLEAUT32.dll","WININET.dll","rtutils.dll","RPCRT4.dll","credssp.dll","CRYPT32.dll","urlmon.dll","USER32.dll","GDI32.dll","SspiCli.dll","shell32.dll","rasman.dll","profapi.dll","SHLWAPI.dll","LPK.dll","ntmarta.dll","iphlpapi.DLL","iertutil.dll","SETUPAPI.dll","Normaliz.dll","mswsock.dll","ncrypt.dll","USP10.dll","rsaenh.dll","USERENV.dll","kernel32.dll","ADVAPI32.dll","comctl32.dll","NLAapi.dll","secur32.dll","CRYPTSP.dll","napinsp.dll","wshtcpip.dll","schannel.DLL","PSAPI.DLL","wintrust.dll","winrnr.dll","sechost.dll","dnsapi.DLL","IMM32.DLL","rasadhlp.dll","msvcrt.dll","GPAPI.dll","VERSION.dll","ntdll.dll","RASAPI32.dll","ole32.dll","DEVOBJ.dll","CFGMGR32.dll","ws2_32.DLL","KERNELBASE.dll","Cabinet.dll","XmlLite.dll","NSI.dll","WS2_32.dll","SAMLIB.dll","Actioncenter.dll","taskschd.dll","wshtcpip.DLL","netprofm.dll","WSCAPI.dll","midimap.dll","AVRT.dll","wer.dll","NetworkExplorer.dll","MSACM32.dll","dwmapi.dll","BatMeter.dll","cryptnet.dll","dhcpcsvc6.DLL","msls31.dll","shdocvw.dll","drprov.dll","SSPICLI.DLL","DUI70.dll","gameux.dll","Secur32.dll","wpdshserviceobj.dll","FXSRESM.DLL","WindowsCodecs.dll","WINHTTP.dll","AltTab.dll","WINTRUST.dll","MsftEdit.dll","WTSAPI32.dll","samcli.dll","actxprxy.dll","Syncreg.dll","fxsst.dll","EhStorShell.dll","dxp.dll","UIAnimation.dll","DUser.dll","slc.dll","DEVRTL.dll","ntlanman.dll","HID.DLL","MPR.dll","nlaapi.dll","VBoxMRXNP.dll","WLDAP32.dll","RpcRtRemote.dll","Wlanapi.dll","LINKINFO.dll","authui.dll","srvcli.dll","ntshrui.dll","werconcpl.dll","OLEACC.dll","wevtapi.dll","CRYPTUI.dll","AUDIOSES.DLL","apphelp.dll","IPHLPAPI.DLL","framedynos.dll","IMM32.dll","WINSTA.dll","FXSAPI.dll","davclnt.dll","PROPSYS.dll","npmproxy.dll","ehSSO.dll","CLBCatQ.DLL","wwapi.dll","ieproxy.dll","UxTheme.dll","WINNSI.DLL","ksuser.dll","POWRPROF.dll","imapi2.dll","msiltcfg.dll","stobject.dll","SndVolSSO.DLL","hcproviders.dll","fwpuclnt.dll","PortableDeviceTypes.dll","es.dll","WINMM.dll","DAVHLPR.dll","ATL.DLL","shacct.dll","SyncCenter.dll","SXS.DLL","cscapi.dll","prnfldr.dll","wkscli.dll","wercplsupport.dll","tiptsf.dll","MMDevApi.dll","EXPLORERFRAME.dll","wscinterop.dll","provsvc.dll","netshell.dll","ieframe.dll","SHELL32.dll","hgcpl.dll","srchadmin.dll","PortableDeviceApi.dll","msi.dll","wlanutil.dll","IconCodecService.dll","wwanapi.dll","netutils.dll","QUtil.dll","wshqos.dll","dhcpcsvc.DLL","gdiplus.dll","pnidui.dll","QAgent.dll","normaliz.dll","msasn1.dll","ws2_32.dll","SensApi.dll","winhttp.dll","shlwapi.dll","imm32.dll","cryptsp.dll","rasapi32.dll","cabinet.dll","setupapi.dll","wininet.dll","rpcrt4.dll","usp10.dll","nsi.dll","cryptbase.dll","WinSCard.dll","sspicli.dll","cfgmgr32.dll","dhcpcsvc6.dll","dhcpcsvc.dll","userenv.dll","winnsi.dll","bcrypt.dll","KernelBase.dll","advapi32.dll","dnsapi.dll","gpapi.dll","devobj.dll","psapi.dll","crypt32.dll","msctf.dll","devrtl.dll","webio.dll","Wldap32.dll","gdi32.dll","WSHTCPIP.DLL","user32.dll","lpk.dll","oleaut32.dll","schannel.dll","NapiNSP.dll","FWPUCLNT.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SCHEDLGU.TXT","sha256":"eecd41248968c69e858255607a3e5f4393fcc352ca0c8a2b38a6d9b4cb941c66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"}]},{"name":"setupact.log","sha256":"66eb51c62e5147e614f00e63293e9cc9e8f3ce0c6fd60eef61a7caab3cdaf992","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"b4d5f5695a818b4d52955c0335da27713dd019a15da217528f9d0e747594cc1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"221_132_35_56[1].txt","sha256":"d61b05e98d0dd0f5e5e0012d9441df59c43bceb69e569486b94417e4793d384f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"CabA648.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"CabA919.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"CabE132.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"TarA659.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"TarA91A.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"TarE133.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Tar4BF4.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"Tar507A.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"Tar721E.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"Cab4BE4.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"Cab506A.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"Cab721D.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"1925a95e2d7a9ecf9f4e7d0353ff11d322a0f32aeaf84411cfc17830aada87b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"\\Device\\NetBT_Tcpip6_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"}]},{"path":"\\Device\\NetBT_Tcpip_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"}]},{"path":"\\Device\\NetBT_Tcpip6_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"}]},{"path":"\\Device\\NetBT_Tcpip6_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\221_132_35_56[1].txt","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\slideshow.ini","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"path":"%TEMP%\\Cab4BE4.tmp","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%TEMP%\\Cab506A.tmp","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%TEMP%\\Cab721D.tmp","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"},{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"563359120e316d6c5771428b"},{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"Global\\48f562dbb8c259a21cd487370cacd1eb","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\754263eee840f9e21f6dcd119ef9878f","sources":[{"report_type":"sandbox","report_id":"563339740e316d892e54120e"}]}]}},"report_ids":{"sandbox_job_ids":["563359120e316d6c5771428b","563339740e316d892e54120e","563339740e316d892e54120c"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 5c095d6ea673… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5c095d6ea673…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 12 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 5c095d6ea673… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5c095d6ea673…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 12 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 5c095d6ea673… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5c095d6ea673…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 12 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]