26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 66112715198d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 66112715198d…. Malware family: Trojan.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165"],"about":{"@type":"SoftwareApplication","name":"66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T509,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "../..\base/allocator/partition_allocator/page_allocator_internals_win.h(123) Check failed: VirtualFree(reinterpret_cast(address), 0, MEM_RELEASE)" (Indicator: "VirtualFree"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "../..\base/allocator/partition_allocator/page_allocator_internals_win.h(145) Check failed: VirtualFree(reinterpret_cast(address), length, MEM_DECOMMIT)" (Indicator: "VirtualFree"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003660.00000000.135377.72BD1000.00000020.mdmp")28:T8da,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "((((DWORD )0x00000000L) ) + 0 ) == WaitForSingleObject(thread_handle.platform_handle(), 0xFFFFFFFF)" (Indicator: "WaitForSingleObject"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp, 00000000-00003660.00000000.135377.72BE5000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp, 00000000-00003660.00000000.135377.72BE5000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp")29:T867,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp, 00000000-00003660.00000000.135377.72BE5000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp, 00000000-00003660.00000000.135377.72BE5000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004432.00000001.136082.008F2000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004432.00000001.136082.008F2000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005044.00000000.135662.1D800000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005044.00000000.135662.1D800000.00000004.mdmp")2a:T2139,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005044-00000BC0-1112884178") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp")2b:T8f8,"(ERROR_SUCCESS) == GetLastError()" (Indicator: "GetLastError"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "result != 0 || GetLastError() != ERROR_INVALID_HANDLE" (Indicator: "GetLastError"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "GetLastError"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp, 00000000-00003660.00000000.135377.72BE5000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp, 00000000-00003660.00000000.135377.72BE5000.00000002.mdmp")44:T63e,Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00004432.00000001.136082.008F2000.00000002.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00004432.00000001.136082.008F2000.00000002.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00005044.00000000.135662.02E00000.00000004.mdmp, 00000000-00005044.00000000.135662.1D800000.00000004.mdmp, 00000000-00005044.00000001.135756.02E00000.00000004.mdmp, 00000000-00005044.00000001.135756.1D800000.00000004.mdmp, 00000000-00005044.00000001.135756.1D84A000.00000004.mdmp, 00000000-00005044.00000001.135756.1D863000.00000004.mdmp, 00000000-00005044.00000001.135756.1D88C000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Structures|STARTUPINFO|wShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00005044.00000000.135662.02E00000.00000004.mdmp, 00000000-00005044.00000000.135662.1D800000.00000004.mdmp, 00000000-00005044.00000001.135756.02E00000.00000004.mdmp, 00000000-00005044.00000001.135756.1D800000.00000004.mdmp, 00000000-00005044.00000001.135756.1D84A000.00000004.mdmp, 00000000-00005044.00000001.135756.1D863000.00000004.mdmp, 00000000-00005044.00000001.135756.1D88C000.00000004.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005044.00000000.135662.1D800000.00000004.mdmp")45:T210f,"Software\Microsoft\Windows\CurrentVersion" in Source: 66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin "Software\WinRAR SFX" in Source: 66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin "SOFTWARE\Classes\%s\%s" in Source: 36921-264-0099A5B5 "Software\Microsoft\Windows Script Host\Settings" in Source: 36921-269-009A5A24 "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 36921-316-009A7236 "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00003660.00000000.135377.00991000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003660.00000000.135377.00991000.00000020.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00003660.00000000.135377.00991000.00000020.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003660.00000000.135377.03240000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003660.00000000.135377.03240000.00000004.mdmp "stry\Machine\Software\Classes\.bat\OpenWithProgids" in Source: 00000000-00003660.00000000.135377.03240000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003660.00000000.135377.03240000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "HKEY_CLASSES_ROOT\tdesktop.tg\shell\open\command" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Valve\Steam" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Runj" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "Software\\" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004432.00000000.136068.04FD0000.00000004.mdmp 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0Z" in Source: 00000000-00005044.00000000.135662.1D800000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005044.00000000.135662.1D800000.00000004.mdmp 00000000-00005044.00000001.135756.1D800000.00000004.mdmp46:T92f,Process " (Indicator: "password"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp")63:T91a,Found string "[Down]V" (Indicator: "[down]"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "[Left]X" (Indicator: "[left]"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "[Right]X" (Indicator: "[right]"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "[ESC]V" (Indicator: "[esc]"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "[CTRL]X" (Indicator: "[ctrl]"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "[CTRL]X" (Indicator: "[Ctrl]"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "[Shift]V" (Indicator: "[shift]"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "[Back]T" (Indicator: "[Back]"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "[Tab]h" (Indicator: "[tab]"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "[CAPSLOCK: OFF]f" (Indicator: "[CAPSLOCK: OFF]"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "[CAPSLOCK: ON]" (Indicator: "[CAPSLOCK: ON]"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp")64:T67c,Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "SELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "SELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "Select * From Win32_ComputerSystem&" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp")65:T4cd,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003660.00000000.135377.03240000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004432.00000000.136068.02F80000.00000004.mdmp, 00000000-00004432.00000001.136082.02F80000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004432.00000000.136068.02F80000.00000004.mdmp, 00000000-00004432.00000001.136082.02F80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005044.00000000.135662.029F0000.00000004.mdmp, 00000000-00005044.00000001.135756.029F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005044.00000000.135662.029F0000.00000004.mdmp, 00000000-00005044.00000001.135756.029F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00005044.00000000.135662.029F0000.00000004.mdmp, 00000000-00005044.00000001.135756.029F0000.00000004.mdmp")66:T5ad,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003660.00000000.135377.009A9000.00000002.mdmp, 00000000-00003660.00000000.135377.72BE5000.00000002.mdmp") Found reference to API "Win32API|Process and Thread Functions|TerminateProcess|uExitCode" (Indicator: "TerminateProcess"; Source: "00000000-00005044.00000000.135662.1D800000.00000004.mdmp, 00000000-00005044.00000001.135756.1D800000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005044.00000000.135662.1D800000.00000004.mdmp, 00000000-00005044.00000001.135756.1D800000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|TerminateProcess|uExitCods" (Indicator: "TerminateProcess"; Source: "00000000-00005044.00000000.135662.1D800000.00000004.mdmp")67:T4b0,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; File: "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00005044.00000000.135662.1D800000.00000004.mdmp, 00000000-00005044.00000001.135756.1D800000.00000004.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00005044.00000000.135662.1D800000.00000004.mdmp, 00000000-00005044.00000001.135756.1D800000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00005044.00000000.135662.1D800000.00000004.mdmp, 00000000-00005044.00000001.135756.1D800000.00000004.mdmp, 00000000-00005044.00000001.135756.1D84A000.00000004.mdmp")68:Ta30,"nul\" (Indicator: \"w32tm \"; Source: \"00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-519","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00003660-36921-75-009A5341\n GetProcessHeap@KERNEL32.DLL at 00000000-00003660-36921-77-009A52DC\n GetProcessHeap@KERNEL32.DLL at 00000000-00003660-36921-80-009A52C5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"HostdhcpCommonSvcdllCommon.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Adobe\\HostdhcpCommonSvcdllCommon.exe\" at 00000000-00005044-00000C17-1112888239\n \"SppExtComObj.exe\" queries volume information of \"C:\\TorService\\data\\SppExtComObj.exe\" at 00000000-00004432-00000C17-1119086789","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\", Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0\n Culture=neutral\n PublicKeyToken=b77a5c561934e089\"/>\"\n \"127.0.0.1\"\n \"2.5.29.10\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.37\"\n \"192.168.0.1\"\n \"255.255.255.255\"\n Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" />\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$59","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://wdcp.microsoft.com/wdcp.svc/submitreportindows\" - Source: \"00000000-00003660.00000000.135377.03750000.00000004.mdmp\")\n Found URL \"http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan\" - Source: \"00000000-00003660.00000000.135377.72BD1000.00000020.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp\")\n Found string \"HTTP/1.1 400 Bad Request\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"a0571516.xsph.ru\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"SppExtComObj.exe\"\n YARA signature for AES encryption matched on file \"RuntimeBroker.exe\"\n YARA signature for AES encryption matched on file \"OSPPSVC.exe\"\n YARA signature for AES encryption matched on file \"VSSVC.exe\"\n YARA signature for AES encryption matched on file \"ctfmon.exe\"\n YARA signature for AES encryption matched on file \"HostdhcpCommonSvcdllCommon.exe\"\n YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on process \"00000000-00005044\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktop\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00004432.00000001.136082.008F2000.00000002.mdmp\")\n Found reference to API \"CreateDesktop\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00005044.00000000.135662.1D800000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003660.00000000.135377.03240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003660.00000000.135377.72BE5000.00000002.mdmp\")\n Found reference to API \"4372598010,4256,3025,,RtlGetNtProductType,NTDLL.dll,\"00:35:22.984\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00004432.00000000.136068.02F80000.00000004.mdmp, 00000000-00004432.00000001.136082.02F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004432.00000000.136068.04FD0000.00000004.mdmp, 00000000-00004432.00000001.136082.04FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00004432.00000001.136082.008F2000.00000002.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00004432.00000001.136082.008F2000.00000002.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00004432.00000001.136082.008F2000.00000002.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005044.00000000.135662.1D800000.00000004.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00005044.00000000.135662.1D800000.00000004.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00005044.00000000.135662.1D800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003660.00000000.135377.009A9000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00003660.00000000.135377.009A9000.00000002.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00004432.00000001.136082.008F2000.00000002.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005044.00000000.135662.1D800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69e20a953788997b150ea732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"