34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 39:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4a5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Titirez.Generic Sample 5d225036372c… — Score 93/100 — Hybrid Analysis","description":"Malicious verdict for sample 5d225036372c…. Malware family: Mint.Titirez.Generic. Threat score 93/100. 23/28 AV engines flagged this file. 4 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45","keywords":["Malicious","Mint.Titirez.Generic","malware analysis","sandbox report","threat intelligence","5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45"],"about":{"@type":"SoftwareApplication","name":"2017-11-17_02-46-00.exe","applicationCategory":["peexe","executable"],"identifier":"5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45","additionalType":"Malicious sample"},"threatScore":93,"malwareFamily":"Mint.Titirez.Generic","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4f7,"" wrote 32 bytes to a remote process "C:\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe" (Handle: 76) "" wrote 52 bytes to a remote process "C:\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe" (Handle: 76) "" wrote 4 bytes to a remote process "C:\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe" (Handle: 76) "" wrote 1024 bytes to a remote process "C:\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe" (Handle: 76) "" wrote 60928 bytes to a remote process "C:\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe" (Handle: 76) "" wrote 6656 bytes to a remote process "C:\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe" (Handle: 76) "" wrote 3584 bytes to a remote process "C:\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe" (Handle: 76) "" wrote 12288 bytes to a remote process "C:\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe" (Handle: 76) "" wrote 1536 bytes to a remote process "C:\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe" (Handle: 76)37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAiIiAiICAAIgAAAAAAAAAAAAIgAAAAACIAAAAAAAAB3d3d3AAAIAIiAAAAAAAd3eIiIh3dwgIAAiAAAAAd3eIh3d3iHd3AACIAAAAB3eHd3d3d3d4d3AAAAAAAHeId3d4d3d3d4h3AAAAAAd4d3d3h3d4d3d3h3AAAAAHeHd3d3d3d3d3d4dwAAAAd4d3d3d4h4d3d3d4dwAAAHd3d3d3d3d4d3h3d3cAAAB4iHd3d3d3eHd4d3eHAAAHeIiHd3d3d3d3eHd3h3AAB4iIiIh3eAAHeIh4eIhwAAeIiIiIh4iAAHeIeHd4cACHiIiIiHeIiIB3eIeHeHAIh4iIiIh3iIAAd4iIiIhwCIeIiIiIh4AAiHeIiIiIcAiHiIiIiId4gId3d4iIiHAAh3iIiIiId3d3d3d3eIdwAIB4iIiIiIh3h3d3d3eHAACAd4iIiIiIiIh3d3d3dwAAAHeIiIiIiIiId3d3d3cAAACHeIiIiIiIiHd3d4d4CACAB3iIiIiIiIiHd3eHcIiAAAB3iIiIiIiIiHeIdwgAgAAAB3eIiIiIiIh3d3gIAAAAAAh3d4iIiIiId3cAAAAAAAAICHd3iIiId3cAAAAAAAAAAIAAB3d3d3gIAAAAAAAAAAAACAAAgACACAAAAAAAAAAAAAAIAAgIAAAAAAAAD//ggA//+P6P/AAgD/gAAc/gAAOfwAAD/4AAAP8AAAD+AAAAfgAAAH4AAAA+AAAAPAAAADwACAA8AAYAOAACADAAAAAwADgAMAAAADgAAAAwAAAAOgAAADoAAABKAAAACQAAAA+AAAFvgAABL8AAB/+AAA//7wBf//zsn///Nb/w==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAiIiAiICAAIgAAAAAAAAAAAAIgAAAAACIAAAAAAAAB3d3d3AAAIAIiAAAAAAAd3eIiIh3dwgIAAiAAAAAd3eIh3d3iHd3AACIAAAAB3eHd3d3d3d4d3AAAAAAAHeId3d4d3d3d4h3AAAAAAd4d3d3h3d4d3d3h3AAAAAHeHd3d3d3d3d3d4dwAAAAd4d3d3d4h4d3d3d4dwAAAHd3d3d3d3d4d3h3d3cAAAB4iHd3d3d3eHd4d3eHAAAHeIiHd3d3d3d3eHd3h3AAB4iIiIh3eAAHeIh4eIhwAAeIiIiIh4iAAHeIeHd4cACHiIiIiHeIiIB3eIeHeHAIh4iIiIh3iIAAd4iIiIhwCIeIiIiIh4AAiHeIiIiIcAiHiIiIiId4gId3d4iIiHAAh3iIiIiId3d3d3d3eIdwAIB4iIiIiIh3h3d3d3eHAACAd4iIiIiIiIh3d3d3dwAAAHeIiIiIiIiId3d3d3cAAACHeIiIiIiIiHd3d4d4CACAB3iIiIiIiIiHd3eHcIiAAAB3iIiIiIiIiHeIdwgAgAAAB3eIiIiIiIh3d3gIAAAAAAh3d4iIiIiId3cAAAAAAAAICHd3iIiId3cAAAAAAAAAAIAAB3d3d3gIAAAAAAAAAAAACAAAgACACAAAAAAAAAAAAAAIAAgIAAAAAAAAD//ggA//+P6P/AAgD/gAAc/gAAOfwAAD/4AAAP8AAAD+AAAAfgAAAH4AAAA+AAAAPAAAADwACAA8AAYAOAACADAAAAAwADgAMAAAADgAAAAwAAAAOgAAADoAAABKAAAACQAAAA+AAAFvgAABL8AAB/+AAA//7wBf//zsn///Nb/w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":93,"unified_at_epoch_ms":1793899915377,"unified_at":"2026-11-05T17:31:55.377Z","metadata":{"hashes":{"sha256":"5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45","sha1":"dce0b9e12463d5871aa0d1412c4209a27f2c586f","md5":"959415720743377d66b229435de15722","sha512":"196715021a543d1032b5be28c82a5bd50a6920c9df7411b4a24a63f0d38396fe7f9cd5144da281255651bbcd3e77dfb6ddb1ca21d66952eea35bf77761497f68","ssdeep":"3072:NZMhKgskCv6wsHGRACklp3/5/jCrG50N6FS0ENUdyudT9:YhVGljsxxQ3eS0E29","ssdeep_chunks":["3072:NZMhKgs","3072:ZMhKgsk","3072:MhKgskC","3072:hKgskCv","3072:KgskCv6","3072:gskCv6w","3072:skCv6ws","3072:kCv6wsH","3072:Cv6wsHG","3072:v6wsHGR","3072:6wsHGRA","3072:wsHGRAC","3072:sHGRACk","3072:HGRACkl","3072:GRACklp","3072:RACklp3","3072:ACklp3/","3072:Cklp3/5","3072:klp3/5/","3072:lp3/5/j","3072:p3/5/jC","3072:3/5/jCr","3072:/5/jCrG","3072:5/jCrG5","3072:/jCrG50","3072:jCrG50N","3072:CrG50N6","3072:rG50N6F","3072:G50N6FS","3072:50N6FS0","3072:0N6FS0E","3072:N6FS0EN","3072:6FS0ENU","3072:FS0ENUd","3072:S0ENUdy","3072:0ENUdyu","3072:ENUdyud","3072:NUdyudT","3072:UdyudT9","6144:NZMhKgs","6144:ZMhKgsk","6144:MhKgskC","6144:hKgskCv","6144:KgskCv6","6144:gskCv6w","6144:skCv6ws","6144:kCv6wsH","6144:Cv6wsHG","6144:v6wsHGR","6144:6wsHGRA","6144:wsHGRAC","6144:sHGRACk","6144:HGRACkl","6144:GRACklp","6144:RACklp3","6144:ACklp3/","6144:Cklp3/5","6144:klp3/5/","6144:lp3/5/j","6144:p3/5/jC","6144:3/5/jCr","6144:/5/jCrG","6144:5/jCrG5","6144:/jCrG50","6144:jCrG50N","6144:CrG50N6","6144:rG50N6F","6144:G50N6FS","6144:50N6FS0","6144:0N6FS0E","6144:N6FS0EN","6144:6FS0ENU","6144:FS0ENUd","6144:S0ENUdy","6144:0ENUdyu","6144:ENUdyud","6144:NUdyudT","6144:UdyudT9","3072:YhVGljs","3072:hVGljsx","3072:VGljsxx","3072:GljsxxQ","3072:ljsxxQ3","3072:jsxxQ3e","3072:sxxQ3eS","3072:xxQ3eS0","3072:xQ3eS0E","3072:Q3eS0E2","3072:3eS0E29"],"imphash":"6c75f3d85fe69304a056f054210859f1"},"file_info":{"file_name":"2017-11-17_02-46-00.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":220672,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1510887302000,"last_seen":1676636979000,"last_multi_scan":1676636979000}},"detections":{"summary":{"verdict":"malicious","score":93,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":4,"suspicious_count":6,"malicious_count":4,"total":14},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Inject","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1213131","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Titirez.ny0@aeu1UEdi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-6377265-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Crypt.BC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-285d3111!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Titirez.ny0@aeu1UEdi (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FZFV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Adware ( 00539ed31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXFO-WN!959415720743","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Nymaim.evaewg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/GandCrab-D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_EMOTET.SMD3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_EMOTET.SMD3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DownLoad3.CRGB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenKryptik.Win32.11974","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Mint.Titirez.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 13615-547-02001241\n SetUnhandledExceptionFilter@KERNEL32.dll at 13615-1282-02001892","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 13615-1294-0200608D","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00015560-00003620)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.38680243849","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"C:\\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe\", Handle: 76)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW\n GetModuleFileNameA\n OpenProcess\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n TerminateProcess\n FindFirstFileExA\n WriteFile\n FindNextFileA\n ExitThread\n GetModuleHandleW\n GetModuleHandleExW\n CreateFileW\n IsDebuggerPresent\n GetTickCount\n VirtualAlloc\n GetFileSize","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"c4ca3c7780bb3c77aa6e3d779fbb3c7708bb3c7746ce3c7761383d77de2f3d77d0d93c770000000017790f774f910f777f6f0f77f4f70f7711f70f77f2830f77857e0f7700000000\" to virtual address \"0x6A871000\" (part of module \"MSIMG32.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/65 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"10/65 Antivirus vendors marked spawned process \"\" (PID: 3620) as malicious (classified as \"QVM10.1.3BEC.Malware\" with 15% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$36","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":20,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"5a0e4dbc7ca3e124ce4f4039","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":93,"malware_family":"QVM10.1.3BEC.Malware","submit_name":"2017-11-17_02-46-00.exe","analysis_start_time":"2017-11-17T03:44:17+00:00","indicators_count":{"informative":4,"suspicious":7,"malicious":6},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}],"processes":[{"pid":2268,"ppid":0,"name":"5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe","command_line":"","sha256":"5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45","normalized_path":"C:\\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe","uid":"00014781-00002268","icon":"$37"},{"pid":3620,"ppid":2268,"name":"5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe","command_line":"","sha256":"5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45","normalized_path":"C:\\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe","parent_uid":"00014781-00002268","uid":"00015560-00003620","icon":"$38"}],"all_imported_dlls":["usp10.dll","msctf.dll","shlwapi.dll","shell32.dll","advapi32.dll","sechost.dll","gdi32.dll","imm32.dll","dwmapi.dll","rpcrt4.dll","user32.dll","lpk.dll","msvcrt.dll","msimg32.dll","apphelp.dll","ntdll.dll","kernel32.dll","KernelBase.dll","uxtheme.dll","comctl32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45.exe","sources":[{"report_type":"sandbox","report_id":"5a0e4dbc7ca3e124ce4f4039"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a0e4dbc7ca3e124ce4f4039"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Mint.Titirez.Generic Sample 5d225036372c… — Score 93/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5d225036372c…. Malware family: Mint.Titirez.Generic. Threat score 93/100. 23/28 AV engines flagged this file. 4 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45"}],["$","meta","4",{"property":"og:title","content":"Malicious Mint.Titirez.Generic Sample 5d225036372c… — Score 93/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5d225036372c…. Malware family: Mint.Titirez.Generic. Threat score 93/100. 23/28 AV engines flagged this file. 4 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5d225036372c54faf72e630fb0af3ca5498a85be12c8480375b78d4da316df45"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Mint.Titirez.Generic Sample 5d225036372c… — Score 93/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5d225036372c…. Malware family: Mint.Titirez.Generic. Threat score 93/100. 23/28 AV engines flagged this file. 4 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]] 32:null