24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Malware.Generic Sample 6724c041fe0d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6724c041fe0d…. Malware family: Trojan.Malware.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 12 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6724c041fe0df61a619006bf1df4a759f4f22a65e2afda32501760ebc9ebe25d","keywords":["Malicious","Trojan.Malware.Generic","malware analysis","sandbox report","threat intelligence","6724c041fe0df61a619006bf1df4a759f4f22a65e2afda32501760ebc9ebe25d"],"about":{"@type":"SoftwareApplication","name":"a03ae3a480dd17134b04dbc5e62bf57b.exe","applicationCategory":["peexe","executable"],"identifier":"6724c041fe0df61a619006bf1df4a759f4f22a65e2afda32501760ebc9ebe25d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Malware.Generic","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T617,Process "explorer.exe" (UID: 00055834-00001264) was launched with new environment variables: "SESSIONNAME="Console"" Process "explorer.exe" (UID: 00055834-00001264) was launched with modified environment variables: "Path" Process "explorer.exe" (UID: 00055834-00001264) was launched with missing environment variables: "PROMPT, MpConfig_ProductUserAppDataPath, MpConfig_ProductAppDataPath, MpConfig_ProductPath, MpConfig_ProductCodeName, MpConfig_ReportingGUID" Process "w7e89.tmp" (UID: 00055928-00002992) was launched with new environment variables: "SESSIONNAME="Console"" Process "w7e89.tmp" (UID: 00055928-00002992) was launched with modified environment variables: "Path" Process "w7e89.tmp" (UID: 00055928-00002992) was launched with missing environment variables: "PROMPT, MpConfig_ProductUserAppDataPath, MpConfig_ProductAppDataPath, MpConfig_ProductPath, MpConfig_ProductCodeName, MpConfig_ReportingGUID" Process "cmd.exe" (UID: 00056010-00001932) was launched with new environment variables: "PROMPT="$P$G", MpConfig_ProductUserAppDataPath="C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows Defender", MpConfig_ProductAppDataPath="C:\ProgramData\Microsoft\Windows Defender", MpConfig_ProductPath="C:\Program Files\Windows Defender", MpConfig_ProductCodeName="AntiSpyware", MpConfig_ReportingGUID="D9765A22-4A32-46A9-92CB-043F61DC4FA2"" Process "cmd.exe" (UID: 00056010-00001932) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00056010-00001932) was launched with missing environment variables: "SESSIONNAME"26:T446,"" touched file "C:\Windows\AppPatch\sysmain.sdb" "SVCHOST.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "explorer.exe" touched file "C:\Windows\System32" "explorer.exe" touched file "C:\Windows\System32\sysprep\sysprep.exe" "explorer.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "explorer.exe" touched file "C:\Windows\System32\sysprep" "explorer.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk" "explorer.exe" touched file "C:\Windows\System32\msconfig.exe" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\dcd5734867e97.customDestinations-ms" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\cbc036d6fdb69fb5.customDestinations-ms"27:T92c,"" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\SVCHOST.exe" (Handle: 56) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\SVCHOST.exe" (Handle: 56) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\SVCHOST.exe" (Handle: 56) "SVCHOST.exe" wrote 96 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 56 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 28 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 84 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 80 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 158 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 24 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 20 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 13 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 15 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 12 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 17 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 16 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 134 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "SVCHOST.exe" wrote 1120 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 36) "explorer.exe" wrote 32 bytes to a remote process "C:\Windows\System32\sysprep\sysprep.exe" (Handle: 2916) "explorer.exe" wrote 52 bytes to a remote process "C:\Windows\System32\sysprep\sysprep.exe" (Handle: 2916) "explorer.exe" wrote 4 bytes to a remote process "C:\Windows\System32\sysprep\sysprep.exe" (Handle: 2916) "sysprep.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\w7e89.tmp" (Handle: 324) "sysprep.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\w7e89.tmp" (Handle: 324) "sysprep.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\w7e89.tmp" (Handle: 324)28:T75c,YARA signature "Codoso_Gh0st_1" classified file "a03ae3a480dd17134b04dbc5e62bf57b.exe.bin" as "apt,codoso,plugx" based on indicators: "45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a007b00330061006400300035003500370035002d0038003800350037002d0034003800350030002d0039003200370037002d003100310062003800350062006400620038006500300039007d00,45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a00" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, Author: Florian Roth) YARA signature "Codoso_Gh0st_1" classified file "SVCHOST.exe" as "apt,codoso,plugx" based on indicators: "45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a007b00330061006400300035003500370035002d0038003800350037002d0034003800350030002d0039003200370037002d003100310062003800350062006400620038006500300039007d00,45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a00" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, Author: Florian Roth) YARA signature "Codoso_Gh0st_2" classified file "SVCHOST.exe" as "apt,codoso,plugx" based on indicators: "45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a007b00330061006400300035003500370035002d0038003800350037002d0034003800350030002d0039003200370037002d003100310062003800350062006400620038006500300039007d00" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, Author: Florian Roth) Internal YARA signature matched on process "w7e89.tmp" Internal YARA signature matched on process "a03ae3a480dd17134b04dbc5e62bf57b.exe" Internal YARA signature matched on file "all.bstring"29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6724c041fe0df61a619006bf1df4a759f4f22a65e2afda32501760ebc9ebe25d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790639994606,"unified_at":"2026-09-28T23:59:54.606Z","metadata":{"hashes":{"sha256":"6724c041fe0df61a619006bf1df4a759f4f22a65e2afda32501760ebc9ebe25d","sha1":"3cafe7d0a200dd577a6e0a31dde4a2315ead156c","md5":"a03ae3a480dd17134b04dbc5e62bf57b","sha512":"350d0c0f9697f6eb19ef41ccf23043d01840132add931dc08abfe7373e58aee4b3326fa51f1b6f76e8ae988c2f2b98b44d121165dc86c36efb901a2309f095df","ssdeep":"12288:TltrUYThY3K1SoBFxxXVXHhPL3gHwwVNvlKxeIuq1o1R7:TlNUYiSSgzVRPL3gwwVZq2H7","ssdeep_chunks":["12288:TltrUYT","12288:ltrUYTh","12288:trUYThY","12288:rUYThY3","12288:UYThY3K","12288:YThY3K1","12288:ThY3K1S","12288:hY3K1So","12288:Y3K1SoB","12288:3K1SoBF","12288:K1SoBFx","12288:1SoBFxx","12288:SoBFxxX","12288:oBFxxXV","12288:BFxxXVX","12288:FxxXVXH","12288:xxXVXHh","12288:xXVXHhP","12288:XVXHhPL","12288:VXHhPL3","12288:XHhPL3g","12288:HhPL3gH","12288:hPL3gHw","12288:PL3gHww","12288:L3gHwwV","12288:3gHwwVN","12288:gHwwVNv","12288:HwwVNvl","12288:wwVNvlK","12288:wVNvlKx","12288:VNvlKxe","12288:NvlKxeI","12288:vlKxeIu","12288:lKxeIuq","12288:KxeIuq1","12288:xeIuq1o","12288:eIuq1o1","12288:Iuq1o1R","12288:uq1o1R7","24576:TltrUYT","24576:ltrUYTh","24576:trUYThY","24576:rUYThY3","24576:UYThY3K","24576:YThY3K1","24576:ThY3K1S","24576:hY3K1So","24576:Y3K1SoB","24576:3K1SoBF","24576:K1SoBFx","24576:1SoBFxx","24576:SoBFxxX","24576:oBFxxXV","24576:BFxxXVX","24576:FxxXVXH","24576:xxXVXHh","24576:xXVXHhP","24576:XVXHhPL","24576:VXHhPL3","24576:XHhPL3g","24576:HhPL3gH","24576:hPL3gHw","24576:PL3gHww","24576:L3gHwwV","24576:3gHwwVN","24576:gHwwVNv","24576:HwwVNvl","24576:wwVNvlK","24576:wVNvlKx","24576:VNvlKxe","24576:NvlKxeI","24576:vlKxeIu","24576:lKxeIuq","24576:KxeIuq1","24576:xeIuq1o","24576:eIuq1o1","24576:Iuq1o1R","24576:uq1o1R7","12288:TlNUYiS","12288:lNUYiSS","12288:NUYiSSg","12288:UYiSSgz","12288:YiSSgzV","12288:iSSgzVR","12288:SSgzVRP","12288:SgzVRPL","12288:gzVRPL3","12288:zVRPL3g","12288:VRPL3gw","12288:RPL3gww","12288:PL3gwwV","12288:L3gwwVZ","12288:3gwwVZq","12288:gwwVZq2","12288:wwVZq2H","12288:wVZq2H7"],"imphash":"dd862027ea7a1cfbce47b6c5e9ec6582"},"file_info":{"file_name":"a03ae3a480dd17134b04dbc5e62bf57b.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":756736,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1528758731000,"last_seen":1678942386000,"last_multi_scan":1678942386000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["dembr","elevate","gael","genasom","gop","guardianofpeace","hyteod","jokrapackedircbot","keydoor","kovter","operationtroy","pemalform","ransomware","silentchollima","targeted","whoisteam","apt","apt19","c0d0so","codoso","plugx","sunshopgroup","irc","ircbot","tiggre"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":24,"suspicious_count":18,"malicious_count":12,"total":54},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.XwDoor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Genome","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1224168","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Trojan.Malware.UmW@aOy3uici","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Trojan.Malware.UmW@aOy3uici (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Keydoor.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.IRCbot.afwd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan.mu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agent.756736.AJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_HCKBNDL.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_HCKBNDL.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan-Spy.Zbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Generic.Win32.3442","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Malware.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"},{"type":"suspicious","value":"Contains ability to open/control a service"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Injects into explorer"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Injects into remote processes"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1036","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate services"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 48714-3722-0042B3EA\n SetUnhandledExceptionFilter@KERNEL32.dll at 48714-6289-00478103\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00055020-00001452-4389-12-00478FF4\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00055020-00001452-4389-33-00474F5F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00055020-00001452-4389-2209-0042B3EA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00055020-00001452-4389-3800-00478103\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00055428-00003112-26811-33-00098A57\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00055428-00003112-26811-12-000983E7\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00055428-00003112-26811-351-0009638D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00055928-00002992-33977-12-0042A6C0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00055928-00002992-33977-33-0042A4AA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00055928-00002992-33977-1406-0042CDEF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 48714-3696-004307E9\n GetSystemTimeAsFileTime@KERNEL32.dll at 48714-3670-0042E9F4\n GetSystemTimeAsFileTime@KERNEL32.dll at 48714-6274-00432FB4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00055020-00001452-4389-199-00478BE5\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00055020-00001452-4389-2183-004307E9\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00055020-00001452-4389-2157-0042E9F4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00055020-00001452-4389-3782-00432FB4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00055428-00003112-26811-157-0009766F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00055928-00002992-33977-210-0042D8D1\n GetLocalTime@KERNEL32.dll at 48361-417-1000F0A0\n GetLocalTime@KERNEL32.dll at 48361-627-100012C0\n GetLocalTime@KERNEL32.dll at 48361-603-10001BF0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00055020-00001452-4389-46-00473105","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [esp+0000020Ch], 05h\" and \"jne 004733E0h\" at 00055020-00001452-4389-46-00473105\n Found API call GetLocalTime@KERNEL32.dll directly followed by \"cmp esi, dword ptr [100249D4h]\" and \"jnl 10001C50h\" at 48361-603-10001BF0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 48714-3041-00428F88\n GetProcessHeap@KERNEL32.dll at 48714-3030-0042C498\n GetProcessHeap@KERNEL32.dll at 48714-3596-0042C282\n GetProcessHeap@KERNEL32.DLL at 00055020-00001452-4389-119-0047C07F\n GetProcessHeap@KERNEL32.DLL at 00055020-00001452-4389-1307-0042C498\n GetProcessHeap@KERNEL32.DLL at 00055020-00001452-4389-1317-00428F88\n GetProcessHeap@KERNEL32.DLL at 00055020-00001452-4389-2083-0042C282\n GetProcessHeap@KERNEL32.DLL at 00055928-00002992-33977-118-004308F3\n GetProcessHeap@KERNEL32.dll at 48361-470-1001A53D","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"sysprep.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\")\\Win32\\Release\\HttpSecurityProvider.pdb\"\n \")\\x64\\Release\\HttpSecurityProvider.pdb\"\n \"F:\\WORKING\\Win7ElevateV2_Source\\Win32\\Release\\Win7ElevateDll32.pdb\"\n \"F:\\WORKING\\Win7ElevateV2_Source\\x64\\Release\\Win7ElevateDll64.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\SVCHOST.exe\"\n \"\" created file \"%TEMP%\\w7e89.tmp\"\n \"\" created file \"%TEMP%\\ud.bat\"\n \"SVCHOST.exe\" created file \"%TEMP%\\w7e881D.tmp\"\n \"w7e89.tmp\" created file \"%TEMP%\\~ER9D15.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}\"\n \"{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}\"\n \"\\Sessions\\1\\BaseNamedObjects\\SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\WdsSetupLogInit\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog\"\n \"Global\\WdsSetupLogInit\"\n \"SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc\"\n \"Global\\SetupLog\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$25","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c %TEMP%\\\\ud.bat\" on 2018-6-12.17:13:22.055","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"SVCHOST.exe\" with commandline \"\"%TEMP%\\w7e89.tmp\"\" (UID: 00055428-00003112)\n Spawned process \"sysprep.exe\" with commandline \"\"\"%TEMP%\\w7e89.tmp\"\" \"%WINDIR%\\system32\" \"*n/a\"\" (UID: 00055885-00003236)\n Spawned process \"w7e89.tmp\" with commandline \"*n/a\" (UID: 00055928-00002992)\n Spawned process \"cmd.exe\" with commandline \"cmd /c %TEMP%\\\\ud.bat\" (UID: 00056010-00001932)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"sysprep.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"ud.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"\n \"SVCHOST.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"diagerr.xml\" has type \"UTF-8 Unicode (with BOM) text with very long lines\"\n \"setuperr.log\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"\n \"w7e89.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"setupact.log\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"\n \"w7e881D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"~ER9D15.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"diagwrn.xml\" has type \"UTF-8 Unicode (with BOM) text\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"cmd.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.hanja-edu.com/bbs/login_ok.php\"\n Pattern match: \"http://www.theumin.net/bbs/login_ok.php\"\n Pattern match: \"http://delmundo.kr/bbs/login_ok.php\"\n Pattern match: \"http://%s\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"a03ae3a480dd17134b04dbc5e62bf57b.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"SVCHOST.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"w7e89.tmp\" was detected as \"VC8 -> Microsoft Corporation\"\n \"w7e881D.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"~ER9D15.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"sysprep.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceA@ADVAPI32.DLL at 00055928-00002992-33977-149-00427B96\n OpenServiceA@ADVAPI32.dll at 48361-570-10005E20\n OpenServiceA@ADVAPI32.dll at 48361-515-10005CE0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00055020-00001452-00000105-7545405682\n \"SVCHOST.exe\" queried SystemProcessInformation at 00055428-00003112-00000105-14949264434","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 11 calls to GetProcAddress@KERNEL32.DLL at 00055428-00003112-26811-132-00091000","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 54701-275-10006988\n cpuid at 58354-727-00415DC0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/62 reputation engines marked \"http://delmundo.kr/bbs/login_ok.php\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to create a remote thread (often used for process injection)","description":"CreateRemoteThread@KERNEL32.DLL at 00055428-00003112-26811-51-00092BC0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-5","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to write to a remote process","description":"WriteProcessMemory@KERNEL32.DLL at 00055428-00003112-26811-52-000943D0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-34","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%TEMP%\\SVCHOST.exe\", Handle: 56)\n \"\" is creating a new process\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 56)\n \"explorer.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\sysprep\\sysprep.exe\", Handle: 2916)\n \"sysprep.exe\" is creating a new process (Name: \"%TEMP%\\w7e89.tmp\", Handle: 324)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"SVCHOST.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"w7e89.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"w7e881D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"~ER9D15.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00055020-00001452-4389-137-00472F93\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00055428-00003112-26811-122-00093B90","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%TEMP%\\SVCHOST.exe\" marked \"%TEMP%\\w7e881D.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\\"%TEMP%\\SVCHOST.exe\" \"%TEMP%\\w7e89.tmp\"\" with delete access\n \"SVCHOST.exe\" opened \"%TEMP%\\w7e881D.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"w7e881D.tmp\" claimed CRC 59968 while the actual is CRC 275775\n \"~ER9D15.tmp\" claimed CRC 179155 while the actual is CRC 59968","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n WinExec\n DeleteFileA\n UnhandledExceptionFilter\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n LoadLibraryW\n GetModuleHandleA\n WriteFile\n GetModuleHandleW\n TerminateProcess\n CreateProcessA\n CreateFileW\n Sleep\n GetTickCount\n CreateFileA\n OpenProcessToken\n CreateToolhelp32Snapshot\n VirtualAllocEx\n CreateRemoteThread\n WriteProcessMemory\n OpenProcess\n GetCommandLineW\n DeleteFileW\n VirtualProtectEx\n Process32FirstW\n GetTempFileNameW\n Process32NextW\n GetTempPathW\n CreateServiceA\n StartServiceA\n RegCreateKeyExA\n RegEnumKeyExA\n GetStartupInfoA\n CreateProcessW\n VirtualAlloc\n RegCloseKey\n CryptEncrypt\n RegDeleteValueA\n RegOpenKeyExA\n CreateFileMappingA\n GetFileAttributesA\n GetDriveTypeA\n OpenFileMappingA\n CopyFileA\n CreateThread\n ExitThread\n GetFileSize\n FindFirstFileA\n GetComputerNameA\n FindNextFileA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"SVCHOST.exe\" at non-system pathway \"%TEMP%\\SVCHOST.exe\" with commandline \"\"%TEMP%\\w7e89.tmp\"\" (UID: 00055428-00003112)","origin":"Monitored Target","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Found a system process name at an unusual pathway","description":"Process \"SVCHOST.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00055428-00003112)","origin":"Monitored Target","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/64 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"42/64 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"42/65 Antivirus vendors marked dropped file \"SVCHOST.exe\" as malicious (classified as \"Gen:Trojan.Heur.RP\" with 64% detection rate)\n 43/55 Antivirus vendors marked dropped file \"w7e89.tmp\" as malicious (classified as \"Gen:Trojan.Heur\" with 78% detection rate)\n 28/66 Antivirus vendors marked dropped file \"w7e881D.tmp\" as malicious (classified as \"Agent.43520\" with 42% detection rate)\n 41/66 Antivirus vendors marked dropped file \"~ER9D15.tmp\" as malicious (classified as \"DeepScan:Generic.Malware.IFB\" with 62% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"42/65 Antivirus vendors marked spawned process \"SVCHOST.exe\" (PID: 3112) as malicious (classified as \"Gen:Trojan.Heur.RP\" with 64% detection rate)\n 43/55 Antivirus vendors marked spawned process \"w7e89.tmp\" (PID: 2992) as malicious (classified as \"Gen:Trojan.Heur\" with 78% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"SVCHOST.exe\" allocated memory in \"%TEMP%\\w7e881D.tmp\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00055834-00001264)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2018-6-12.17:13:20.326 (UID: 00055834-00001264)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$27","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$28","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00055020-00001452)\n Spawned process \"SVCHOST.exe\" with commandline \"\"%TEMP%\\w7e89.tmp\"\" (UID: 00055428-00003112)\n Spawned process \"sysprep.exe\" with commandline \"\"\"%TEMP%\\w7e89.tmp\"\" \"%WINDIR%\\system32\" \"*n/a\"\" (UID: 00055885-00003236)\n Spawned process \"w7e89.tmp\" with commandline \"*n/a\" (UID: 00055928-00002992)\n Spawned process \"cmd.exe\" with commandline \"cmd /c %TEMP%\\\\ud.bat\" (UID: 00056010-00001932)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetModuleFileNameA@KERNEL32.DLL at 00009128-00003020-53186-140-00473007","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"delmundo.kr\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"explorer.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"SVCHOST.exe\" with commandline \"\"%TEMP%\\w7e89.tmp\"\" (UID: 00009400-00002464)\n Spawned process \"sysprep.exe\" with commandline \"\"\"%TEMP%\\w7e89.tmp\"\" \"%WINDIR%\\system32\" \"*n/a\"\" (UID: 00009549-00002896)\n Spawned process \"w7e89.tmp\" with commandline \"*n/a\" (UID: 00009574-00002448)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\\\ud.bat\" (UID: 00009733-00001700)\n Spawned process \"cmd.exe\" with commandline \"/c %TEMP%\\~RF6018.bat\" (UID: 00009968-00002944)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"w7e89.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESSKIT\"; Key: \"TYPE\"; Value: \"20000000\")\n \"w7e89.tmp\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SHAREDACCESSKIT\\PARAMETERS\")\n \"w7e89.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESSKIT\\PARAMETERS\"; Key: \"SERVICEDLL\"; Value: \"%SystemRoot%\\System32\\msipnathlp.dll\")\n \"w7e89.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESSKIT\\PARAMETERS\"; Key: \"SERVICEMAIN\"; Value: \"ServiceMain\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"EnumServicesStatusExA@ADVAPI32.dll at 5414-363-0000000180006750\n EnumServicesStatusExA@ADVAPI32.dll at 5414-518-00000001800065B4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1120","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"w7e89.tmp\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)\n \"w7e89.tmp\" called \"OpenSCManager\" requesting access rights \"0X20000000\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"delmundo.kr\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"711130017a3b2f01ab8b02007f950200fc8c0200729602006cc805001ecd2c017d262c01\" to virtual address \"0x769107E4\" (part of module \"USER32.DLL\")\n \"cmd.exe\" wrote bytes \"711130017a3b2f01ab8b02007f950200fc8c0200729602006cc805001ecd2c017d262c01\" to virtual address \"0x769107E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]}],"incidents":[{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Injects into remote processes"},{"detail":"Spawns a lot of processes"},{"detail":"Injects into explorer"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":41,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":52,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["dembr","elevate","gael","genasom","gop","guardianofpeace","hyteod","jokrapackedircbot","keydoor","kovter","operationtroy","pemalform","ransomware","silentchollima","targeted","whoisteam","apt","apt19","c0d0so","codoso","plugx","sunshopgroup","irc","ircbot","tiggre"],"sample_flags":["Multi-Process","Extracted Files","Network Traffic","Sample not shared","TOR analysis"],"sandbox_reports":[{"id":"5bda90257ca3e11f9e3461e0","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dropper.Trojan.Generic","submit_name":"6724c041fe0df61a619006bf1df4a759f4f22a65e2afda32501760ebc9ebe25d.exe","analysis_start_time":"2018-11-01T06:36:43+00:00","indicators_count":{"informative":22,"suspicious":21,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true},{"id":"5b1f01cb7ca3e12e71508c09","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Trojan.Heur.JP","submit_name":"a03ae3a480dd17134b04dbc5e62bf57b.exe","analysis_start_time":"2018-06-13T02:08:31+00:00","indicators_count":{"informative":19,"suspicious":15,"malicious":15},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"delmundo.kr","country":"-","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}],"processes":[{"pid":3020,"ppid":0,"name":"6724c041fe0df61a619006bf1df4a759f4f22a65e2afda32501760ebc9ebe25d.exe","command_line":"","sha256":"6724c041fe0df61a619006bf1df4a759f4f22a65e2afda32501760ebc9ebe25d","normalized_path":"C:\\6724c041fe0df61a619006bf1df4a759f4f22a65e2afda32501760ebc9ebe25d.exe","uid":"00009128-00003020","icon":"$29"},{"pid":2464,"ppid":3020,"name":"SVCHOST.exe","command_line":"\"%TEMP%\\w7e89.tmp\"","sha256":"0daad03483cc6a13dd1435f7632f2e5a50c6808a62ee808251f5e9a6bf39f999","normalized_path":"%TEMP%\\SVCHOST.exe","parent_uid":"00009128-00003020","uid":"00009400-00002464"},{"pid":1340,"ppid":2464,"name":"explorer.exe","command_line":"","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00009400-00002464","uid":"00009523-00001340"},{"pid":2896,"ppid":1340,"name":"sysprep.exe","command_line":"\"\"%TEMP%\\w7e89.tmp\"\" \"%WINDIR%\\system32\" \"*n/a\"","sha256":"59b6fa978781bc2a54b4020b8af48509cffe7fc45fae7c7cc65ee9e7f4341876","normalized_path":"%WINDIR%\\System32\\sysprep\\sysprep.exe","parent_uid":"00009523-00001340","uid":"00009549-00002896"},{"pid":2448,"ppid":2896,"name":"w7e89.tmp","command_line":"*n/a","sha256":"29167554471dbaf1bd317caca4ff382999893e35a4c4d3a1b7e4ffcb1efa42a9","normalized_path":"%TEMP%\\w7e89.tmp","parent_uid":"00009549-00002896","uid":"00009574-00002448"},{"pid":2944,"ppid":2448,"name":"cmd.exe","command_line":"/c %TEMP%\\~RF6018.bat","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00009574-00002448","uid":"00009968-00002944"},{"pid":1700,"ppid":3020,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\\\ud.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00009128-00003020","uid":"00009733-00001700"}],"all_imported_dlls":["CRYPTBASE.dll","winbrand.dll","rpcss.dll","kernel32.dll","KernelBase.dll","gdi32.dll","lpk.dll","msvcrt.dll","apphelp.dll","sfc_os.dll","ole32.dll","ActionQueue.dll","setupapi.dll","uxtheme.dll","dwmapi.dll","imm32.dll","shlwapi.dll","cfgmgr32.dll","msctf.dll","oleaut32.dll","unattend.dll","devobj.dll","advapi32.dll","sechost.dll","rpcrt4.dll","mtxoci.dll","user32.dll","usp10.dll","comsvcs.dll","sfc.dll","imageres.dll","shell32.dll","ntdll.dll","wdscore.dll","comctl32.dll","dbghelp.dll","wow64.dll","wow64win.dll","wow64cpu.dll","cryptbase.dll","sspicli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SVCHOST.exe","sha256":"b6cf214ecb4471cac7f8331074f0c9fde8bfc264b65557db72e1c604a692eda6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"w7e881D.tmp","sha256":"7297b36616f2674d5fde16abbeabd0174d2349f532b0e3a49ccb2057bcb1d0e4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"name":"w7e89.tmp","sha256":"1f76ab073c5f54e438130aa2f60538f11b3861ec784b429d46533c02ac69f568","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"~ER9D15.tmp","sha256":"7c6fa317babf07f1fe5b8f47d4c3d8740e76633e0a29aff9593addfedfd97dfa","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"name":"ud.bat","sha256":"8a5ac7908270d04488a30b5e2df54b37efcdaa9c6d872152dd3a862dd0e0243a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"diagerr.xml","sha256":"53e2362cd5101070264387f590caee54a7cb298b5fe50aabd7dfc409044c4bc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"diagwrn.xml","sha256":"6c06bf950d0fe3476e020cd363ec0c8c9d4ee0fc89a24c50780c44e6453995c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"setupact.log","sha256":"7c7a70896a9ff5851c36ecc8bcaed594c4a33380c51c615055bad219ae1af4a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"setuperr.log","sha256":"2eb71f04702dd4f8eca01bd14cfcd43fae5da5a42b210561d116793212c3053d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"name":"w7e453C.tmp","sha256":"7980d797d5caccf243579e7c4d47e252ec75937e3817eba270c0d25348c45916","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"~ER4DC8.tmp","sha256":"d682b0abcc057ca74d11ff99c28c55892ce9af7798f7ba631a1f24b33c74dc58","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"msipnathlp.dll","sha256":"d682b0abcc057ca74d11ff99c28c55892ce9af7798f7ba631a1f24b33c74dc58","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"~RF6018.bat","sha256":"f5f0b1c7d87062224ff5caa06d8e5eaf84f00dfe7c6858abbcead7d292e2b2a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]}],"files_written":[{"path":"%TEMP%\\SVCHOST.exe","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32\\sysprep\\sysprep.exe","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32\\sysprep\\en-US\\sysprep.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setuperr.log","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\diagerr.xml","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\diagwrn.xml","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setuplog.cfg","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setupact.log","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%TEMP%\\w7e89.tmp","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32\\sysprep","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"C:\\Users\\fl6ssRM","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%TEMP%\\ud.bat","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%TEMP%\\~ER9D15.tmp","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%PROGRAMFILES%\\Microsoft Games\\Solitaire\\Solitaire.exe","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%WINDIR%\\System32\\msconfig.exe","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\dcd5734867e97.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\cbc036d6fdb69fb5.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\1f34f1a500af6119.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b464ae5c58e59aac.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b3f13480c2785ae.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\6f4c76f1482ef052.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\337ed59af273c758.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\bcb504227031d15c.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b91050d8b077a4e8.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%TEMP%\\~ER4DC8.tmp","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32\\msipnathlp.dll","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%TEMP%\\~RF6018.tmp","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%TEMP%\\~RF6018.bat","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"path":"%WINDIR%\\System32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"name":"{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"},{"report_type":"sandbox","report_id":"5bda90257ca3e11f9e3461e0"}]},{"name":"Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"name":"SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]},{"name":"Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5b1f01cb7ca3e12e71508c09"}]}]}},"report_ids":{"sandbox_job_ids":["5bda90257ca3e11f9e3461e0","5b1f01cb7ca3e12e71508c09"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Malware.Generic Sample 6724c041fe0d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6724c041fe0d…. Malware family: Trojan.Malware.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 12 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6724c041fe0df61a619006bf1df4a759f4f22a65e2afda32501760ebc9ebe25d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Malware.Generic Sample 6724c041fe0d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6724c041fe0d…. Malware family: Trojan.Malware.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 12 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6724c041fe0df61a619006bf1df4a759f4f22a65e2afda32501760ebc9ebe25d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Malware.Generic Sample 6724c041fe0d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6724c041fe0d…. Malware family: Trojan.Malware.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 12 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]