21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 58:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious KillMBR.B.Generic Sample 6a1c0e8af033… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6a1c0e8af033…. Malware family: KillMBR.B.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 9 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a","keywords":["Malicious","KillMBR.B.Generic","malware analysis","sandbox report","threat intelligence","6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a"],"about":{"@type":"SoftwareApplication","name":"6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"KillMBR.B.Generic","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Tc3d,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToCoTaskMemAuto" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteByte" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "set_Position" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Read" in "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "RuntimeBroken.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "RuntimeBroken.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToCoTaskMemAuto" in "RuntimeBroken.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "RuntimeBroken.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "RuntimeBroken.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "RuntimeBroken.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "RuntimeBroken.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "RuntimeBroken.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "RuntimeBroken.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "RuntimeBroken.exe"23:T43b,Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RuntimeBroken.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "RuntimeBroken.exe") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp")24:T70c,Found string - \\.\PhysicalDrive0; Source: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") Found string - winmgmts:\\.\root\SecurityCenter2; Source: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") Found string - \.\PhysicalDrive0; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found string - inmgmts:\\.\root\SecurityCenter2; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found string - \.\PhysicalDrive0; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found string - inmgmts:\\.\root\SecurityCenter2; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found string - \\.\root\cimv2; Source: "00000000-00002460.00000000.160921.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp") Found string - \\.\root\SecurityCenter2; Source: "00000000-00002460.00000001.162843.0332E000.00000004.mdmp, 00000000-00002460.00000001.162843.07F10000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.07F1B000.00000004.mdmp, 00000000-00002460.00000002.164763.07F6E000.00000004.mdmp") Found string - \.\root\cimv2; Source: "00000000-00002460.00000001.162843.0332E000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp") Found string - \.\root\SecurityCenter2; Source: "00000000-00002460.00000001.162843.0332E000.00000004.mdmp, 00000000-00002460.00000001.162843.07F10000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.07F6E000.00000004.mdmp") Found string - winmgmts:\\.\root\SecurityCenter2; Source: "00000000-00002460.00000001.162843.057F0000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp")25:T902,"" (Indicator: "enumchildwindows"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "findwindow"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "FindWindowEx" (Indicator: "findwindow"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "findwindow"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "FindWindowEx" (Indicator: "findwindow"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002460.00000000.160921.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp")29:T27ce,"" (Indicator: "GetDC"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002460.00000000.160921.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002460.00000000.160921.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002460.00000000.160921.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002460.00000000.160921.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002460.00000000.160921.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp")4c:T6da,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp")4d:T633,Found string "/" requiresUniqueEmail="false" passwordFormat="Hashed" maxInvalidPasswordAttempts="5" minRequiredPasswo" (Indicator: "password"; Source: "00000000-00002460.00000000.160921.032C0000.00000004.mdmp"), Found string "gth="7" minRequiredNonalphanumericCharacters="1" passwordAttemptWindow="10" passwordStrengthRegularExpr$" (Indicator: "password"; Source: "00000000-00002460.00000000.160921.032C0000.00000004.mdmp"), Found string "applicationName="/" requiresUniqueEmail="false" passwordFormat="Hashed" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="7" minRequiredNonalphanumericCharacters="1" passwordAttemptWindow="10" passwordStrengthRegularExpression=""/>" (Indicator: "password"; Source: "00000000-00002460.00000000.160921.057F0000.00000004.mdmp 00000000-00002460.00000001.162843.057F0000.00000004.mdmp"), Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00002460.00000000.160921.057F0000.00000004.mdmp 00000000-00002460.00000001.162843.057F0000.00000004.mdmp"), Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00002460.00000000.160921.057F0000.00000004.mdmp 00000000-00002460.00000001.162843.057F0000.00000004.mdmp"), Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00002460.00000000.160921.057F0000.00000004.mdmp 00000000-00002460.00000001.162843.057F0000.00000004.mdmp"), file/memory contains long string with (Indicator: "password"; Source: "00000000-00002460.00000000.160921.057F0000.00000004.mdmp 00000000-00002460.00000001.162843.057F0000.00000004.mdmp")4e:T6c1,Found string "Select * From AntiVirusProduct" (Indicator: "antivirusproduct"; File: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") Found string "elect * From AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found string "elect * From AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00002460.00000000.160921.032C0000.00000004.mdmp, 00000000-00002460.00000000.160921.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp") Found string "Select * From AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00002460.00000001.162843.0332E000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.07F10000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.07F1B000.00000004.mdmp") Found string "AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00002460.00000001.162843.0332E000.00000004.mdmp, 00000000-00002460.00000001.162843.07F10000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.07F1B000.00000004.mdmp, 00000000-00002460.00000002.164763.07F35000.00000004.mdmp, 00000000-00002460.00000002.164763.07F62000.00000004.mdmp, 00000000-00002460.00000002.164763.07F6E000.00000004.mdmp") Found string "Select * From AntiVirusProductH" (Indicator: "antivirusproduct"; Source: "00000000-00002460.00000002.164763.032C0000.00000004.mdmp")4f:T678,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00002052.00000000.160654.02B30000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002460.00000000.160921.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00002460.00000000.160921.03D60000.00000002.mdmp, 00000000-00002460.00000001.162843.03D60000.00000002.mdmp, 00000000-00002460.00000002.164763.03D60000.00000002.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00002460.00000001.162843.0332E000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00002460.00000001.162843.0332E000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00002460.00000001.162843.0332E000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp")50:T517,Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") Found reference to API "SetWindowsHookEx" (Indicator: "SetWindowsHook"; File: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "SetWindowsHookEx" (Indicator: "SetWindowsHook"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00002052.00000000.160654.04F30000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "SetWindowsHookEx" (Indicator: "SetWindowsHook"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00002460.00000000.160921.00CB2000.00000002.mdmp")51:T84f,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002052.00000000.160654.02B30000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002460.00000000.160921.032C0000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002460.00000000.160921.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002460.00000000.160921.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$23","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00002052.00000000.160654.00765000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin\"\n Observed function \"System.Reflection.Load\" in \"RuntimeBroken.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"RuntimeBroken.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002052.00000000.160654.04F30000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$24","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00002460.00000000.160921.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002460.00000000.160921.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin\"\n Observed function \"ToBase64String\" in \"6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin\"\n Observed function \"FromBase64String\" in \"RuntimeBroken.exe\"\n Observed function \"ToBase64String\" in \"RuntimeBroken.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"RuntimeBroken.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002052.00000000.160654.04F30000.00000004.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002460.00000000.160921.00CB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"RuntimeBroken.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00002460.00000000.160921.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002460.00000000.160921.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Able to decode string content at runtime (.NET)\n Matched sigs: Contains ability to perform crypto operations","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"RuntimeBroken.exe\" at offset 3556; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 3556; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetLogicalDrives\" in \"6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin\"\n Observed dotnet function \"GetLogicalDrives\" in \"RuntimeBroken.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002460-00000C2C-1511035623\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002052-00000C2C-1503187920\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002052-00000C2C-1503188448\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002460.00000001.162843.0332E000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002460.00000001.162843.0332E000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002460.00000001.162843.0332E000.00000004.mdmp, 00000000-00002460.00000002.164763.032C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"6a1c0e8af033eda2e02b71de4ac3a4562b81d9f64882efca9f0772c6d5137a7a.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002052.00000000.160654.04F30000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002460.00000000.160921.00CB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002460.00000000.160921.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002460.00000000.160921.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp\")\n Found string \"System.Data.Odbc\" (Indicator: \"System.Data.Odbc\"; Source: \"00000000-00002460.00000000.160921.057F0000.00000004.mdmp, 00000000-00002460.00000001.162843.057F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"RuntimeBroken.exe\")\n Found string \"get_ProcessName\" (Source: \"00000000-00002052.00000000.160654.04F30000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00002052.00000000.160654.04F30000.00000004.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00002460.00000000.160921.00CB2000.00000002.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00002460.00000000.160921.00CB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"696fc934ab1f407eb70118e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"