24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T486,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tatrio.Generic Sample 679e5732eabf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 679e5732eabf…. Malware family: Tatrio.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef","keywords":["Malicious","Tatrio.Generic","malware analysis","sandbox report","threat intelligence","679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef"],"about":{"@type":"SoftwareApplication","name":"ZMxUkZd.exe","applicationCategory":["peexe","executable"],"identifier":"679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Tatrio.Generic","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Te59,Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") Found reference to "Rijndael" (Indicator: "Rijndael"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") file/memory contains long string with (Indicator: "CryptoStream"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin") file/memory contains long string with (Indicator: "Rijndael"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin") file/memory contains long string with (Indicator: "RSACryptoServiceProvider"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp")26:Ta71,"" (Indicator: "GetDC"; Source: "00000000-00006668.00000000.131757.032F0000.00000004.mdmp, 00000000-00006668.00000001.133677.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006668.00000000.131757.032F0000.00000004.mdmp, 00000000-00006668.00000001.133677.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006668.00000000.131757.032F0000.00000004.mdmp, 00000000-00006668.00000001.133677.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006668.00000000.131757.032F0000.00000004.mdmp, 00000000-00006668.00000001.133677.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006668.00000000.131757.032F0000.00000004.mdmp, 00000000-00006668.00000001.133677.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006668.00000000.131757.032F0000.00000004.mdmp, 00000000-00006668.00000001.133677.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006668.00000000.131757.032F0000.00000004.mdmp, 00000000-00006668.00000001.133677.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006668.00000000.131757.032F0000.00000004.mdmp, 00000000-00006668.00000001.133677.032F0000.00000004.mdmp")38:Taf4,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; File: "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; Source: "00000000-00006668.00000000.131757.00402000.00000020.mdmp") Found reference to API "27588494746,4148,104,,GetKeyState,user32.dll,"00:34:25.375",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006668.00000001.133677.032F0000.00000004.mdmp") Found reference to API "27588720684,4148,104,,GetKeyState,user32.dll,"00:34:25.375",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006668.00000001.133677.032F0000.00000004.mdmp") Found reference to API "27588681412,4148,104,,GetKeyState,user32.dll,"00:34:25.375",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006668.00000001.133677.032F0000.00000004.mdmp") Found reference to API "83572862714,4148,103,,GetAsyncKeyState,user32.dll,"00:34:48.703",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006668.00000001.133677.033AC000.00000004.mdmp") Found reference to API "83573095388,4148,104,,GetKeyState,user32.dll,"00:34:48.703",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006668.00000001.133677.033AC000.00000004.mdmp") Found reference to API "83573132142,4148,104,,GetKeyState,user32.dll,"00:34:48.703",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006668.00000001.133677.033AC000.00000004.mdmp") Found reference to API "83572553168,4148,104,,GetKeyState,user32.dll,"00:34:48.703",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006668.00000001.133677.033AC000.00000004.mdmp") Found reference to API "83572905630,4148,104,,GetKeyState,user32.dll,"00:34:48.703",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006668.00000001.133677.033AC000.00000004.mdmp") Found reference to API "83573018814,4148,103,,GetAsyncKeyState,user32.dll,"00:34:48.703",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006668.00000001.133677.033AC000.00000004.mdmp") Found reference to API "83573057594,4148,104,,GetKeyState,user32.dll,"00:34:48.703",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006668.00000001.133677.033AC000.00000004.mdmp")39:T9e4,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006668.00000000.131757.032F0000.00000004.mdmp, 00000000-00006668.00000001.133677.032F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"netsh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES\\000000000001\")\n \"netsh.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES\")\n \"netsh.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES\\000000000002\")\n \"netsh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES\\000000000002\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin\")\n file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00006668.00000000.131757.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00007624.00000001.132056.009D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00007624.00000001.132056.009D0000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007624.00000001.132056.009D0000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00007624.00000001.132056.009D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor al\n 05h in Stream UID: 2804-1-00428A3E\n Assembly shows XOR instruction xor al\n 00h in Stream UID: 2804-1-00428A3E\n Assembly shows XOR instruction xor al\n byte ptr [ecx] in Stream UID: 2804-1-00428A3E\n Assembly shows XOR instruction xor eax\n dword ptr [eax] in Stream UID: 2804-1-00428A3E\n Assembly shows XOR instruction xor eax\n FFFEC23Ah in Stream UID: 2804-1-00428A3E\n Assembly shows XOR instruction xor byte ptr [ecx]\n dl in Stream UID: 2804-1-00428A3E\n Assembly shows XOR instruction xor dword ptr [edx+7E200A13h]\n ebx in Stream UID: 2804-1-00428A3E\n Assembly shows XOR instruction xor byte ptr [ecx]\n al in Stream UID: 2804-1-00428A3E\n Assembly shows XOR instruction xor dword ptr [edi]\n edx in Stream UID: 2804-1-00428A3E\n Assembly shows XOR instruction xor ah\n byte ptr [eax] in Stream UID: 2804-1-00428A3E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00006668.00000000.131757.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.CreateDecryptor\" in Source: 679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-357","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.CreateEncryptor\" in Source: 679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-358","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007624.00000001.132056.009D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin\")\n file/memory contains long string with (Indicator: \"RSACryptoServiceProvider\"; File: \"679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006668.00000000.131757.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to decrypt data using RSA (Dotnet String)\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Able to perform cryptographic operations\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Contains ability to encrypt data using RSA (Dotnet String)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin\" at offset 37737; code bytes = 8030\n Found XOR loop in file \"28f09619f7bf2e99383ec4027ff94d69.exe\" at offset 37737; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 37737; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006668-00000C2C-1029930020\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006668-00000C2C-1030122011\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin.exe.bin\")\n Found string \"get_MachineName\" (Source: \"00000000-00006668.00000000.131757.00402000.00000020.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00006668.00000000.131757.00402000.00000020.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00006668.00000000.131757.00402000.00000020.mdmp\")\n Found string \"GetLogicalDrives\" (Source: \"00000000-00006668.00000000.131757.00402000.00000020.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00007624.00000001.132056.009D0000.00000004.mdmp\")\n Found string \"CredUIParseUserNameW\" (Source: \"00000000-00007624.00000001.132056.017A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006668-00000C2C-1029930020\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006668-00000C2C-1030122011\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006668-00000C2C-1028914137\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006668-00000C2C-1028914603\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007624.00000000.131952.017B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00006668.00000000.131757.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageTimeout\" (Indicator: \"sendmessage\"; Source: \"00000000-00006668-00000C2C-1030539729\")\n Found reference to API \"SendMessageTimeoutA\" (Indicator: \"sendmessage\"; Source: \"00000000-00006668-00000C2C-1030539759\")\n Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00006668-00000C2C-1037609029\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00006668-00000C2C-1037609060\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006668.00000000.131757.032F0000.00000004.mdmp, 00000000-00006668.00000001.133677.032F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69c0a54cdfd627c2100d80c6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"