24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Trojan.Updane.gen Sample 6032bfa946ad… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 6032bfa946ad…. Malware family: Trojan.Updane.gen. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","keywords":["Suspicious","Trojan.Updane.gen","malware analysis","sandbox report","threat intelligence","6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af"],"about":{"@type":"SoftwareApplication","name":"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe","applicationCategory":["peexe","executable","compressed","sfx","7zip"],"identifier":"6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"Trojan.Updane.gen","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T239a,Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 452594; code bytes = 30d0 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 505264; code bytes = 30d0 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 594139; code bytes = 30d0 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 617857; code bytes = 30d0 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 793415; code bytes = 30d0 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 969487; code bytes = 30d0 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 382214; code bytes = 33c1 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 674400; code bytes = 33c1 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 728762; code bytes = 33c1 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 871707; code bytes = 33c1 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 39517; code bytes = 8030 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 60934; code bytes = 8030 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 129359; code bytes = 8030 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 406304; code bytes = 8030 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 428151; code bytes = 8030 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 674902; code bytes = 8030 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 783585; code bytes = 8030 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 795452; code bytes = 8030 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 891519; code bytes = 8030 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 912559; code bytes = 8030 Found XOR loop in file "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" at offset 958768; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 105753; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 303813; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 303981; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 304453; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 316253; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 318845; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 456588; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 472124; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 704215; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 707010; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 707257; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 178260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 366372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 423482; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 423579; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 438146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 514023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 526194; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 604388; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 664906; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 723201; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 742558; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 909760; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 984843; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 996402; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1064788; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1110244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1158414; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1281777; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1296559; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1364696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1426928; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1476147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1540507; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1586591; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1650685; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1651095; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 147868; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 156705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 157058; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 157091; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 157124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 157157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 266238; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 302420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 340959; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 362878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 475828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 665232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 682589; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 859102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 948291; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1098459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1160545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1264090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1402724; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1444221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1641231; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1694625; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1725764; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 234458; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 332104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 470820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 594555; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 606425; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 655275; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 841591; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 867643; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 877559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 877957; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 909167; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 933868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 938990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 954818; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 985445; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 991435; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1034807; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1058109; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1104159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1171937; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1269223; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1422098; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1530674; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1542544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1597838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1605749; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1650006; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1738838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1746075; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1747894; code bytes = 803026:Tfdc,"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000001ea504081ea50478a9223700000000acfc9c00226ee7760000a504000000002d6ee7762c3a65af08000000001ea50416e9b377270eb377ffffffff2400000098fc9c00040000000000000055faa32ba8fc9c00f461e9760c1ea5041100000070e541000e000000c0fc9c00856ae9761c23ee7600fd9c00f85fe97608000000936ae8768a6ae876803b65af11000000382043000e00000070e54100d4fc9c00f0234300d4fd9c0070c8e87658be14d9feffffff8a6ae87632764200 (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000000000000040f69c00201aee023cfd9c00822641745bbef5cdfefffffff8fc9c003ce24074650c000020fd9c004fe24074e99cb2770000000000000000000000000000000000000000e26fa8a648fd9c0048fd9c009be83e74060000006bd02bb99c764200c638ee02b5e83e7400ffffff0600000000000000 (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ee020000000000000000b8040000000000000000ee021a010000184af00200000000ff070000ff070000c000ee02ff070000c000ee02388eee020000ee0201400000184af0020000000001000000ff07000000000000d0080000000000007f070000c000ee0200000000010000000000000001000000000000000000000058f59c000000000002000000b804000000000000359e6c8718fa9c006c2a8e7724000000ff070000c000ee020000010138040000c000ee0200000000b804000034fa9c00284af2020000000000000000103af0021c9fee02b011ee02b9440000e010000024000001ff070000288dee02204af202e4504201000000008269a8a6 (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000002174187d217400000000d0a9f6760000ef769011f0762899f002b00eef02182fef0240f69c00feffffffe8f89c00506ab477826688d1feffffff00f79c00eaa9b0772899f00200000000182fef02a11400000a000b00b29721745c76217468762174182fef02b00bf0021400000000000000000000002899f00228f79c00cc2db577182fef0200000000242fef0200000000f8001a7400000000cc0d24385ce8b3776840b2773802000019000000110000001000000000b9ee0260f79c008d9a4674b8b8ee02d41cef020000000080f79c00d4b4ee02d41cef0298f79c0000001a74feffffff0400000020af467400000000000000000300000088f79c00 (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000009573187d957300000000d0a9f6760000ef769011f076f887f002b00eef028036f202f8eb9c00feffffffa0ee9c00506ab477826688d1feffffffb8ec9c00eaa9b077f887f002000000008036f202a11400000a000b00b29795735c769573687695738036f202404ff202140000000000000000000000f887f002e0ec9c00cc2db5778036f202000000008c36f20200000000f8008e7300000000cc0d24385ce8b3776840b277f802000019000000110000001000000000b9ee0218ed9c008d9a4674b8b8ee02cc1df2020000000038ed9c00d4b4ee02cc1df20250ed9c0000008e73feffffff0400000020af4674000000000000000000008e7340ed9c00 (UID: 00000000-00000952)27:T1227,"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter FindFirstStreamW (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter FindNextStreamW (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00000952)28:T5c9a,Found reference to API (Indicator: "MoveFileW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetTickCount"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "WriteFile"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "FindNextFileW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetFilePointer"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetFileTime"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "FormatMessageW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "CreateEventW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "Sleep"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "CompareFileTime"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "FindClose"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "lstrcatW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "VirtualFree"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetLastError"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetLastError"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "LocalFree"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetStdHandle"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "ResetEvent"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetEvent"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetVersionExW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "CreateFileW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "ReadFile"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetFileSize"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetPriorityClass"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "lstrlenW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "DeleteFileW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "CloseHandle"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SysStringLen"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SysFreeString"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SysAllocString"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "VariantClear"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SHGetMalloc"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "KillTimer"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "EnableWindow"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "ShowWindow"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetKeyState"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "MessageBoxW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "LoadCursorW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "CharUpperW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetParent"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "MoveWindow"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "MapDialogRect"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "LoadStringW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "InvalidateRect"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetWindowRect"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetTimer"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetFocus"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GetFocus"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetCursor"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "LoadIconW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "CoInitialize"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "CoUninitialize"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "OleInitialize"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "FindNextStreamW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "FindFirstStreamW"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API (Indicator: "FindNextStreamW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "FindFirstStreamW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "MapDialogRect"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SHGetMalloc"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatus"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetPriorityClass"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp")29:T6e4,"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 742b0000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74230000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "IMM32.DLL" at base 76280000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "COMCTL32.DLL" at base 741a0000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 73df0000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "KERNEL32.DLL" at base 74860000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 745a0000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "OLEAUT32.DLL" at base 779d0000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "RPCRT4.DLL" at base 76d70000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76ef0000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76ef0000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76300000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76a20000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "COMCTL32.DLL" at base 738e0000 "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" loaded module "COMCTL32" at base 736c00002a:T83c,"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" was detected as "7-Zip" and name: "sfx" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" was detected as "7-Zip" and name: "Archive" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" was detected as "Microsoft Linker" and name: "Linker" "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" was detected as "7-Zip" and name: "sfx" "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" was detected as "7-Zip" and name: "Archive" "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" was detected as "Microsoft Linker" and name: "Linker" "Newtonsoft.Json.dll" was detected as "7-Zip" and name: "sfx" "Newtonsoft.Json.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Newtonsoft.Json.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Newtonsoft.Json.dll" was detected as "7-Zip" and name: "Archive" "Newtonsoft.Json.dll" was detected as "Microsoft Linker" and name: "Linker" "Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll" was detected as "7-Zip" and name: "sfx" "Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll" was detected as "7-Zip" and name: "Archive" "Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll" was detected as "Microsoft Linker" and name: "Linker"2b:T4a2,The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O="DigiCert Inc.", C=US" (SHA1: DD:62:30:AC:86:0A:2D:30:6B:DA:38:B1:68:79:52:30:07:FB:41:7E; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert Inc.", C=US" (SHA1: 55:DC:92:3D:78:D6:F6:1E:E5:F8:DB:D3:86:A2:29:05:D3:8A:95:1C; see report for more information)2c:T555,"Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 Mono/.Net assembly 2 sections"- Location: [C:\Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe]- [targetUID: 00000000-00000952] "Newtonsoft.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [C:\Newtonsoft.Json.dll]- [targetUID: 00000000-00000952] "Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 2 sections"- Location: [C:\Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll]- [targetUID: 00000000-00000952] "Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe.config" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [C:\Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe.config]- [targetUID: 00000000-00000952] "Siemens.Gms.AccessControl.SiPassLicenseCountTool.Help.pdf" has type "PDF document version 1.7"- Location: [C:\Help\Siemens.Gms.AccessControl.SiPassLicenseCountTool.Help.pdf]- [targetUID: 00000000-00000952] "Readme_OSS_PDF_GMS_SiPassLicenseCountTool 1.0.pdf" has type "PDF document version 1.7 3 page(s)"- Location: [C:\Readme_OSS_PDF_GMS_SiPassLicenseCountTool 1.0.pdf]- [targetUID: 00000000-00000952]2d:T730,"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")2e:Td80,"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "SIEMENS.GMS.ACCESSCONTROL.SIPASSLICENSECOUNTTOOLSETUP.EXE"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")2f:T433,"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to touch file "C:\Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb"30:T4b5,"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to access non-existent file "C:\MSVCP140.DLL" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to access non-existent file "C:\MSVCP140.dll" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll"31:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000952.00000000.194990.02EE0000.00000004.mdmp, 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000952.00000000.194990.02EE0000.00000004.mdmp, 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000952.00000000.194990.02EE0000.00000004.mdmp, 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000952.00000000.194990.02EE0000.00000004.mdmp, 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000952.00000000.194990.02EE0000.00000004.mdmp, 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000952.00000000.194990.02EE0000.00000004.mdmp, 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000952.00000000.194990.02EE0000.00000004.mdmp, 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000952.00000000.194990.02EE0000.00000004.mdmp, 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp")32:T4ed,"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "FindFirstFileW" with parameter C:\Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "FindFirstFileW" with parameter C:\Help\Siemens.Gms.AccessControl.SiPassLicenseCountTool.Help.pdf (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "FindFirstFileW" with parameter C:\Readme_OSS_PDF_GMS_SiPassLicenseCountTool 1.0.pdf (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "FindFirstFileW" with parameter C:\Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe.config (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "FindFirstFileW" with parameter C:\Newtonsoft.Json.dll (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "FindFirstFileW" with parameter C:\Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe (UID: 00000000-00000952) "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" called "FindFirstFileW" with parameter C:\Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll (UID: 00000000-00000952)33:T5c1,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000952.00000000.194990.0042B000.00000002.mdmp")34:T678,Found string "Enter password" (Indicator: "password"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found string "&Enter password:" (Indicator: "password"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found string "&Show password" (Indicator: "password"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe") Found string "Cannot create folder '{0}'5Update operations are not supported for this archive."Can not open file '{0}' as archive5Can not open encrypted archive '{0}'. Wrong password?" (Indicator: "password"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe"), Found string ")Unsupported compression method for '{0}'.#Data error in '{0}'. File is broken$CRC failed in '{0}'. File is broken.3Data error in encrypted file '{0}'. Wrong password?3CRC failed in encrypted file '{0}'. Wrong password?" (Indicator: "password"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe"), Found string "Wrong password?" (Indicator: "password"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe"), Found string "Wrong password" (Indicator: "password"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe"), Found string "nsupported compression method for '{0}'.#Data error in '{0}'. File is broken$CRC failed in '{0}'. File is broken.3Data error in encrypted file '{0}'. Wrong password?3CRC failed in encrypted file '{0}'. Wrong password?" (Indicator: "password"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe"), Found string "password" (Indicator: "password"; File: "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe")35:T511,"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" wrote 65532 bytes starting with PE header signature to file "C:\Newtonsoft.Json.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" wrote 8936 bytes starting with PE header signature to file "C:\Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe" wrote 15356 bytes starting with PE header signature to file "C:\Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...36:T400,AAABAAEAICAQDAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//////////////////8AAP//////////////////AAD//////////////////wAA//AAAAAAAAD/AAAAD/8AAP/wAAAAAAAA/wAAAA//AAD/8AAA//AAAP8AD////wAA//AAAP/wAAD/AA////8AAP/wAAD/8AAA//AA////AAD/8AAA//AAAP//AA///wAA//AAAP/wAAD///AA//8AAP/wAAAP/wAA////AA//AAD/8AAAAP/wAP8AAAAP/wAA//AAAAAP/wD/AAAAD/8AAP/wD/////8A////////AAD/8A//////AP///////wAA//AAAAAAAAD///////8AAP/wAAAAAAAA////////AAD/8AAAAAAAAP///////wAA//////////////////8AAP//////////////////AAD//////////////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1791586803233,"unified_at":"2026-10-09T23:00:03.233Z","metadata":{"hashes":{"sha256":"6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","sha1":"c43300ec798750cc8c929afc3a21537bfd926b06","md5":"0c9e4a315dde20bc0702b7097c52db39","sha512":"a17d9c0d0b2c538db12259df485664c955aabaf0b30480477157660b32a6d4bd9bed7af02b3002f93802080f47bc26ea459790a57bad1da212f91e6d6918f351","ssdeep":"24576:Ghz5PvhaD3gMrLv1yQ6rq7xHcCpCsjl92VGgprmCNbeDFltpLrHfGwIaSwm7IOg9:GtlhMtckXCU2V4CmRp+wIf7Idrmg","ssdeep_chunks":["24576:Ghz5Pvh","24576:hz5Pvha","24576:z5PvhaD","24576:5PvhaD3","24576:PvhaD3g","24576:vhaD3gM","24576:haD3gMr","24576:aD3gMrL","24576:D3gMrLv","24576:3gMrLv1","24576:gMrLv1y","24576:MrLv1yQ","24576:rLv1yQ6","24576:Lv1yQ6r","24576:v1yQ6rq","24576:1yQ6rq7","24576:yQ6rq7x","24576:Q6rq7xH","24576:6rq7xHc","24576:rq7xHcC","24576:q7xHcCp","24576:7xHcCpC","24576:xHcCpCs","24576:HcCpCsj","24576:cCpCsjl","24576:CpCsjl9","24576:pCsjl92","24576:Csjl92V","24576:sjl92VG","24576:jl92VGg","24576:l92VGgp","24576:92VGgpr","24576:2VGgprm","24576:VGgprmC","24576:GgprmCN","24576:gprmCNb","24576:prmCNbe","24576:rmCNbeD","24576:mCNbeDF","24576:CNbeDFl","24576:NbeDFlt","24576:beDFltp","24576:eDFltpL","24576:DFltpLr","24576:FltpLrH","24576:ltpLrHf","24576:tpLrHfG","24576:pLrHfGw","24576:LrHfGwI","24576:rHfGwIa","24576:HfGwIaS","24576:fGwIaSw","24576:GwIaSwm","24576:wIaSwm7","24576:IaSwm7I","24576:aSwm7IO","24576:Swm7IOg","24576:wm7IOg9","49152:Ghz5Pvh","49152:hz5Pvha","49152:z5PvhaD","49152:5PvhaD3","49152:PvhaD3g","49152:vhaD3gM","49152:haD3gMr","49152:aD3gMrL","49152:D3gMrLv","49152:3gMrLv1","49152:gMrLv1y","49152:MrLv1yQ","49152:rLv1yQ6","49152:Lv1yQ6r","49152:v1yQ6rq","49152:1yQ6rq7","49152:yQ6rq7x","49152:Q6rq7xH","49152:6rq7xHc","49152:rq7xHcC","49152:q7xHcCp","49152:7xHcCpC","49152:xHcCpCs","49152:HcCpCsj","49152:cCpCsjl","49152:CpCsjl9","49152:pCsjl92","49152:Csjl92V","49152:sjl92VG","49152:jl92VGg","49152:l92VGgp","49152:92VGgpr","49152:2VGgprm","49152:VGgprmC","49152:GgprmCN","49152:gprmCNb","49152:prmCNbe","49152:rmCNbeD","49152:mCNbeDF","49152:CNbeDFl","49152:NbeDFlt","49152:beDFltp","49152:eDFltpL","49152:DFltpLr","49152:FltpLrH","49152:ltpLrHf","49152:tpLrHfG","49152:pLrHfGw","49152:LrHfGwI","49152:rHfGwIa","49152:HfGwIaS","49152:fGwIaSw","49152:GwIaSwm","49152:wIaSwm7","49152:IaSwm7I","49152:aSwm7IO","49152:Swm7IOg","49152:wm7IOg9","24576:GtlhMtc","24576:tlhMtck","24576:lhMtckX","24576:hMtckXC","24576:MtckXCU","24576:tckXCU2","24576:ckXCU2V","24576:kXCU2V4","24576:XCU2V4C","24576:CU2V4Cm","24576:U2V4CmR","24576:2V4CmRp","24576:V4CmRp+","24576:4CmRp+w","24576:CmRp+wI","24576:mRp+wIf","24576:Rp+wIf7","24576:p+wIf7I","24576:+wIf7Id","24576:wIf7Idr","24576:If7Idrm","24576:f7Idrmg"],"imphash":"da401ef5e9d5c4599673c26d95fa6029"},"file_info":{"file_name":"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe","file_type":["peexe","executable","compressed","sfx","7zip"],"file_type_id":"exe 7zip sfx","file_size":1750416,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791586724000,"last_seen":1791586724000,"last_multi_scan":1791586724000}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":["updane"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":49},"sandbox_signatures":{"informative_count":107,"suspicious_count":13,"malicious_count":0,"total":120},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.Updane.gen.enak","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Updane.gen","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Contains ability to create directories"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Tries to open documents files"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Contains ability to remove directories"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Stealth","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"suspicious","value":"Drops a file with double extension"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000952.00000000.194990.02EE0000.00000004.mdmp, 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" queried SystemProcessInformation at 00000000-00000952-00000C15-2040364681 [PID: 952]\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" queried SystemProcessInformation at 00000000-00000952-00000C15-2040373217 [PID: 952]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API DllGetVersion@COMCTL32.DLL at 00000000-00000952-16665-460-00401993\n Found reference to API GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00000952-16665-507-004058D5","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor ebx\n ebp in Stream UID: 00000000-00000952-16665-174-00425D50\n Assembly shows XOR instruction xor ebx\n esi in Stream UID: 00000000-00000952-16665-174-00425D50\n Assembly shows XOR instruction xor esi\n ebp in Stream UID: 00000000-00000952-16665-174-00425D50\n Assembly shows XOR instruction xor esi\n edx in Stream UID: 00000000-00000952-16665-174-00425D50\n Assembly shows XOR instruction xor ebp\n esi in Stream UID: 00000000-00000952-16665-174-00425D50\n Assembly shows XOR instruction xor edi\n ebx in Stream UID: 00000000-00000952-16665-174-00425D50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000952.00000000.194990.02EE0000.00000004.mdmp, 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.94886","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$25","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000952-00000C2C-2040646448\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00000952.00000000.194990.02EE0000.00000004.mdmp, 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00000952)\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"GetWindowTextW\" with parameter \"C:\\\" - (UID: 00000000-00000952)\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"GetWindowTextW\" with parameter \"&Background\" - (UID: 00000000-00000952)\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"GetWindowTextW\" with parameter \"&Pause\" - (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GlobalMemoryStatus@KERNEL32.dll at 15507-1044-004058D5\n GetTickCount@KERNEL32.dll at 15507-1295-0041412E\n GetTickCount@KERNEL32.dll at 15507-1316-00414F21\n GetTickCount@KERNEL32.dll at 15507-1892-00413839\n GlobalMemoryStatus@KERNEL32.DLL at 00000000-00000952-16665-507-004058D5\n GetTickCount@KERNEL32.DLL at 00000000-00000952-16665-758-0041412E\n GetTickCount@KERNEL32.DLL at 00000000-00000952-16665-779-00414F21\n GetTickCount@KERNEL32.DLL at 00000000-00000952-16665-1323-00413839","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.dll at 15507-1017-00403E37\n FindNextFileW@KERNEL32.dll at 15507-1020-00403EDE\n FindFirstFileW@KERNEL32.DLL at 00000000-00000952-16665-480-00403E37\n FindNextFileW@KERNEL32.DLL at 00000000-00000952-16665-483-00403EDE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToLocalFileTime@KERNEL32.dll at 15507-1038-004052F1\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00000952-16665-501-004052F1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 15507-669-0041FFB0\n GetVersionExW@KERNEL32.DLL at 00000000-00000952-16665-29-0041FFB0\n GetVersionExW@KERNEL32.DLL at 00000000-00000952-16665-119-004200D0\n DllGetVersion@COMCTL32.DLL at 00000000-00000952-16665-460-00401993\n GetVersionExW@KERNEL32.DLL at 00000000-00000952-16665-462-00401A7C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 15507-1041-004058A6\n GetSystemInfo@KERNEL32.DLL at 00000000-00000952-16665-504-004058A6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"CreateDirectoryW\" with parameter C:\\Help (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"LoadLibrary\" with a parameter imm32.dll (UID: 00000000-00000952)\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"LoadLibrary\" with a parameter comctl32.dll (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForMultipleObjects@KERNEL32.dll at 15507-1084-00407A22\n Sleep@KERNEL32.dll at 15507-1284-0041327D\n SetTimer at 15507-1632-004139BF\n WaitForSingleObject@KERNEL32.DLL at 00000000-00000952-16665-70-004260F0\n WaitForMultipleObjects@KERNEL32.DLL at 00000000-00000952-16665-370-00414A4A\n WaitForMultipleObjects@KERNEL32.DLL at 00000000-00000952-16665-547-00407A22\n Sleep@KERNEL32.DLL at 00000000-00000952-16665-747-0041327D\n SetTimer at 00000000-00000952-16665-1099-004139BF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00000952-16665-460-00401993","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00000952.00000000.194990.02EE0000.00000004.mdmp\n 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:952:168:WilStaging_02\"\n Process Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:952:168:WilStaging_02\"\n Process Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:952:64:WilError_01\"\n Process Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe created mutex with name \"SM0:952:168:WilStaging_02\"\n Process Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe created mutex with name \"SM0:952:64:WilError_01\"\n Process Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe created mutex with name \"Local\\SM0:952:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Newtonsoft.Json.dll\" as clean (type is \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"), Antivirus vendors marked dropped file \"Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll\" as clean (type is \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 2 sections\"), Antivirus vendors marked dropped file \"Siemens.Gms.AccessControl.SiPassLicenseCountTool.Help.pdf\" as clean (type is \"PDF document version 1.7\"), Antivirus vendors marked dropped file \"Readme_OSS_PDF_GMS_SiPassLicenseCountTool 1.0.pdf\" as clean (type is \"PDF document version 1.7 3 page(s)\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Newtonsoft.Json.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00000952.00000000.194990.02EE0000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00000952.00000001.195115.02EE0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77A70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76D70000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$2a","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2b","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" opens a file C:\\Help\\Siemens.Gms.AccessControl.SiPassLicenseCountTool.Help.pdf (UID: 00000000-00000952)\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" opens a file C:\\Readme_OSS_PDF_GMS_SiPassLicenseCountTool 1.0.pdf (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe.config\" has type \"XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators\" - Location: [C:\\Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe.config]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"Newtonsoft.Json.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [C:\\Newtonsoft.Json.dll]- [targetUID: 00000000-00000952]\n \"Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 2 sections\"- Location: [C:\\Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll]- [targetUID: 00000000-00000952]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" queries basic process information of the \"C:\\Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" (UID: 952)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" reads file \"c:\\siemens.gms.accesscontrol.sipasslicensecounttoolsetup.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" trying to access non-existent file \"C:\\SIEMENS.GMS.ACCESSCONTROL.SIPASSLICENSECOUNTTOOLSETUP.EXE.LOCAL\"\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" trying to access non-existent file \"C:\\Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe.Local\\\"\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\UXTHEME.DLL.CONFIG\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" writes file \"c:\\help\\siemens.gms.accesscontrol.sipasslicensecounttool.help.pdf\"\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" writes file \"c:\\readme_oss_pdf_gms_sipasslicensecounttool 1.0.pdf\"\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" writes file \"c:\\siemens.gms.accesscontrol.sipasslicensecounttool.exe.config\"\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" writes file \"c:\\newtonsoft.json.dll\"\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" writes file \"c:\\siemens.gms.accesscontrol.sipasslicensecounttool.exe\"\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" writes file \"c:\\siemens.gms.accesscontrol.sipasslicensecounttool.resources.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"tb.mq\"\n Heuristic match: \",o.pn\"\n Heuristic match: \")k.be\"\n Heuristic match: \"'hi.io\"\n Heuristic match: \"dq6.hn\"\n Heuristic match: \"$g.rs\"\n Pattern match: \"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on process \"00000000-00000952\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"Newtonsoft.Json.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"825923,68,103,,GetAsyncKeyState,user32.dll,\"00:50:48.593\",RX=0,PX=0\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00000952.00000001.195115.02EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"7zAES\" (Indicator: \"aes\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found string \"7zAES\" (Indicator: \"aes\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found string \"P~AeS\" (Indicator: \"aes\"; Source: \"00000000-00000952.00000000.194990.00432000.00000004.mdmp, 00000000-00000952.00000001.195115.00432000.00000004.mdmp\")\n Found string \"PQAeS~\" (Indicator: \"aes\"; Source: \"00000000-00000952.00000000.194990.00432000.00000004.mdmp, 00000000-00000952.00000001.195115.00432000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$34","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000952.00000000.194990.02EE0000.00000004.mdmp\")\n Found string \"NDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000952.00000001.195115.02EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000952.00000000.194990.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"DllGetVersion\" (Source: Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe, API is part of module: COMCTL32.DLL)\n Found string \"FindNextStreamW\" (Source: Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe, API is part of module: KERNELBASE.DLL)\n Found string \"FindFirstStreamW\" (Source: Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GlobalMemoryStatusEx\" (Source: Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe, API is part of module: KERNELBASE.DLL)\n Found string \"SetDefaultDllDirectories\" (Source: Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"C:\\Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe\" has high entropy 7.61821\n Dropped file \"C:\\Help\\Siemens.Gms.AccessControl.SiPassLicenseCountTool.Help.pdf\" has high entropy 7.99293\n Dropped file \"C:\\Readme_OSS_PDF_GMS_SiPassLicenseCountTool 1.0.pdf\" has high entropy 7.81163","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@KERNEL32.dll at 15507-1142-00403AD3\n CreateDirectoryW@KERNEL32.dll at 15507-1174-00403C23\n CreateDirectoryW@KERNEL32.DLL at 00000000-00000952-16665-605-00403AD3\n CreateDirectoryW@KERNEL32.DLL at 00000000-00000952-16665-637-00403C23","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 Mono/.Net assembly 2 sections\"- Location: [C:\\Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe]- [targetUID: 00000000-00000952]\n \"Newtonsoft.Json.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [C:\\Newtonsoft.Json.dll]- [targetUID: 00000000-00000952]\n \"Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 2 sections\"- Location: [C:\\Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll]- [targetUID: 00000000-00000952]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$35","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe\"\n YARA signature for null IAT Directory of PE file \"Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.dll at 15507-1052-00405AA0\n SystemParametersInfoW@USER32.DLL at 00000000-00000952-16665-515-00405AA0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"27\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.DLL at 00000000-00000952-16665-342-00401043","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.DLL at 00000000-00000952-16665-455-004038F6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@KERNEL32.dll at 15507-1519-00403AB8\n RemoveDirectoryW@KERNEL32.DLL at 00000000-00000952-16665-986-00403AB8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a file with double extension","description":"Dropped a double extension file \"Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe.config\"","origin":"Binary File","mitre_attack_id":"T1036.007","relevance":5,"id":"binary-80","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]}],"intel_graph":{"map":{"File:2331c344f7c629799a166f3fb33c12d09b0fe8acf0fe41424e56b4387b768d98":{"type":"File","value":"2331c344f7c629799a166f3fb33c12d09b0fe8acf0fe41424e56b4387b768d98"},"File:4f53fde2254687d78a8f1fe8b8eca04f8859e737aba5efd70d0372d2fe8c535c":{"type":"File","value":"4f53fde2254687d78a8f1fe8b8eca04f8859e737aba5efd70d0372d2fe8c535c"},"File:6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af":{"type":"File","value":"6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af"},"File:83bb74f86837d38ff46707dd2a4a47ee7ff8c4ae8ce8e898c92725c8e2944dae":{"type":"File","value":"83bb74f86837d38ff46707dd2a4a47ee7ff8c4ae8ce8e898c92725c8e2944dae"},"File:87281cccce5fc929447b75fb21054415b242b78d5cdd9392b650f5772caea931":{"type":"File","value":"87281cccce5fc929447b75fb21054415b242b78d5cdd9392b650f5772caea931"},"File:e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d":{"type":"File","value":"e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d"},"File:e779b7dd9caea015e00ca9ff8d96aa141d1932d3dd08aad7566f782f3435b4b4":{"type":"File","value":"e779b7dd9caea015e00ca9ff8d96aa141d1932d3dd08aad7566f782f3435b4b4"}},"chains":[{"id":"sandbox_files","root":"File:6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","edges":[{"edge_kind":"extracted","from_key":"File:6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","to_key":"File:83bb74f86837d38ff46707dd2a4a47ee7ff8c4ae8ce8e898c92725c8e2944dae"},{"edge_kind":"extracted","from_key":"File:6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","to_key":"File:e779b7dd9caea015e00ca9ff8d96aa141d1932d3dd08aad7566f782f3435b4b4"},{"edge_kind":"extracted","from_key":"File:6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","to_key":"File:e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d"},{"edge_kind":"extracted","from_key":"File:6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","to_key":"File:2331c344f7c629799a166f3fb33c12d09b0fe8acf0fe41424e56b4387b768d98"},{"edge_kind":"extracted","from_key":"File:6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","to_key":"File:4f53fde2254687d78a8f1fe8b8eca04f8859e737aba5efd70d0372d2fe8c535c"},{"edge_kind":"extracted","from_key":"File:6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","to_key":"File:87281cccce5fc929447b75fb21054415b242b78d5cdd9392b650f5772caea931"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":49,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["updane"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6ac971a3d9a844b208009d8c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":70,"malware_family":"Trojan.Updane.gen","submit_name":"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe","analysis_start_time":"2026-10-09T22:58:44+00:00","indicators_count":{"informative":107,"suspicious":25,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}],"processes":[{"pid":952,"ppid":0,"name":"Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe","command_line":"","sha256":"6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af","normalized_path":"C:\\Siemens.Gms.AccessControl.SiPassLicenseCountToolSetup.exe","uid":"00000000-00000952","icon":"$36"}],"all_imported_dlls":["kernel.appcore.dll","profapi.dll","ws2_32.dll","CoreMessaging.dll","win32u.dll","uxtheme.dll","msctf.dll","CoreUIComponents.dll","ntmarta.dll","cryptbase.dll","gdi32.dll","shell32.dll","VxSSL32.dll","msvcp140.dll","dwmapi.dll","wow64.dll","user32.dll","kernel32.dll","bcryptprimitives.dll","imm32.dll","vcruntime140.dll","comctl32.dll","clbcatq.dll","wow64win.dll","ucrtbase.dll","sechost.dll","gdi32full.dll","advapi32.dll","cryptsp.dll","TextInputFramework.dll","KernelBase.dll","oleaut32.dll","rpcrt4.dll","msvcrt.dll","powrprof.dll","WinTypes.dll","combase.dll","cfgmgr32.dll","windows.storage.dll","ExplorerFrame.dll","sspicli.dll","ntdll.dll","wow64cpu.dll","shlwapi.dll","fltLib.dll","apphelp.dll","msvcp_win.dll","ole32.dll","SHCore.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe","sha256":"83bb74f86837d38ff46707dd2a4a47ee7ff8c4ae8ce8e898c92725c8e2944dae","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"name":"Siemens.Gms.AccessControl.SiPassLicenseCountTool.Help.pdf","sha256":"e779b7dd9caea015e00ca9ff8d96aa141d1932d3dd08aad7566f782f3435b4b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"name":"Newtonsoft.Json.dll","sha256":"e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"name":"Readme_OSS_PDF_GMS_SiPassLicenseCountTool 1.0.pdf","sha256":"2331c344f7c629799a166f3fb33c12d09b0fe8acf0fe41424e56b4387b768d98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"name":"Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll","sha256":"4f53fde2254687d78a8f1fe8b8eca04f8859e737aba5efd70d0372d2fe8c535c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"name":"Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe.config","sha256":"87281cccce5fc929447b75fb21054415b242b78d5cdd9392b650f5772caea931","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"path":"C:\\Help","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"path":"C:\\Help\\Siemens.Gms.AccessControl.SiPassLicenseCountTool.Help.pdf","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"path":"C:\\Readme_OSS_PDF_GMS_SiPassLicenseCountTool 1.0.pdf","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"path":"C:\\Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe.config","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"path":"C:\\Newtonsoft.Json.dll","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"path":"C:\\Siemens.Gms.AccessControl.SiPassLicenseCountTool.exe","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"path":"C:\\Siemens.Gms.AccessControl.SiPassLicenseCountTool.resources.dll","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:952:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"name":"SM0:952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"name":"SM0:952:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]},{"name":"Local\\SM0:952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac971a3d9a844b208009d8c"}]}]}},"report_ids":{"sandbox_job_ids":["6ac971a3d9a844b208009d8c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Trojan.Updane.gen Sample 6032bfa946ad… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 6032bfa946ad…. Malware family: Trojan.Updane.gen. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af"}],["$","meta","4",{"property":"og:title","content":"Suspicious Trojan.Updane.gen Sample 6032bfa946ad… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 6032bfa946ad…. Malware family: Trojan.Updane.gen. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6032bfa946ada6b244231b6a6753fca194bbdfdce51e9bfd57095fc9261835af"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Trojan.Updane.gen Sample 6032bfa946ad… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 6032bfa946ad…. Malware family: Trojan.Updane.gen. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]]