34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 40:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4f5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 6aaf20d71b3f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6aaf20d71b3f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/27 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6aaf20d71b3fee590bd3e78dbf01ed31ef2a33e6278d6b83da79b9669e0311a9","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","6aaf20d71b3fee590bd3e78dbf01ed31ef2a33e6278d6b83da79b9669e0311a9"],"about":{"@type":"SoftwareApplication","name":"6aaf20d71b3fee590bd3e78dbf01ed31ef2a33e6278d6b83da79b9669e0311a9","applicationCategory":["peexe","executable"],"identifier":"6aaf20d71b3fee590bd3e78dbf01ed31ef2a33e6278d6b83da79b9669e0311a9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T2b64,Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStockObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "InternetOpenA"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "EnumDeviceDrivers"; Source: "sample.bin"), Found reference to API (Indicator: "SetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateAcceleratorA"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "SysAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "MoveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "IsBadReadPtr"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageA"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "InternetOpenUrlA"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "PostMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "Thread32Next"; Source: "sample.bin"), Found reference to API (Indicator: "SysFreeString"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorA"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassNameA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterClassA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "IsChild"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureStackBackTrace"; Source: "sample.bin"), Found reference to API (Indicator: "wvsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateAcceleratorTableA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "Thread32First"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleBaseNameA"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "URLDownloadToFileA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetCapture"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "InternetReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "EnumChildWindows"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "MapWindowPoints"; Source: "sample.bin"), Found reference to API (Indicator: "GetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseCapture"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "IIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "KillTimer"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SysAllocString"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin")37:Tc0a,"LCMapStringEx LCIDToLocaleName LocaleNameToLCID RoInitialize RoUninitialize AppPolicyGetProcessTerminationMethod AppPolicyGetThreadInitializationType Sunday Monday Tuesday Wednesday Thursday Friday Saturday January February August September October November December MM/dd/yy dddd, MMMM dd, yyyy HH:mm:ss NAN(SNAN) nan(snan) NAN(IND) nan(ind) ?8bunz8 ?@En[vP [*ncd>0 S>$hkDh$h>[2 UA>N0Wl A03>A| Q5rHg,> j>>A?1 .>PJ;I:qE> :>t6k' ])6M>& CWD>~3 :>)* v _oD>Kg N>O=I9 F>qUxv /2GG>!B zY;>u:m P>q_Y~ 0><[cZUg^> Y>kX>M H[>: />58d% >jtm}S )>6{1n r Vr.>T +f)>0' ;H9>&X *StO9>T n03>Pu K~Je#>! bp(=>?g BC?>6t9^ c:> K&>.yC .xJ>Hf y\PD>! |b=})> c [1>H' uzKs@> 3>N;kU kE>fvw V6E>`"(5 hspLLD PDB. notification_helper.exe.pdb notification_helper.exe GetHandleVerifier RoOriginateError BuildExplicitAccessWithNameW BuildSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW EventRegister EventUnregister EventWrite RegCl", "[2 UA>N0Wl 9>expf _hypot _nextafter A03>A| Q5rHg,> j>>A?1 .>PJ;I:qE> :>t6k' ])6M>& CWD>~3 :>)* v _oD>Kg N>O=I9 F>qUxv /2GG>!B zY;>u:m P>q_Y~ 0><[cZUg^> Y>kX>M H[>: />58d% >jtm}S )>6{1n r Vr.>T +f)>0' ;H9>&X *StO9>T n03>Pu K~Je#>! bp(=>?g BC?>6t9^ c:> K&>.yC .xJ>Hf y\PD>! |b=})> c [1>H' uzKs@> 3>N;kU kE>fvw V6E>`"(5 -9D /9a remainder FlsAlloc FlsFree FlsGetValue FlsSetValue 1#QNAN 1#SNAN LLD PDB. chrome.exe.pdb AccessCheck AddMandatoryAce AdjustTokenPrivileges BuildExplicitAccessWithNameW BuildSecurityDescriptorW BuildTrusteeWithSidW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid DuplicateToken DuplicateTokenEx EqualSid EventRegister EventUnregister EventWrite FreeSid GetAce GetKernelObjectSecurity GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorDacl GetSecurityDescriptorSacl GetSecurityInfo GetSidSubAuthority GetTokenInformation ImpersonateLoggedOnUser Imp", "ND) nan(ind) ?8bunz8 ?@En[vP [*ncd>0 S>$hkDh$h>[2 UA>N0Wl A03>A| Q5rHg,> j>>A?1 .>PJ;I:qE> :>t6k' ])6M>& CWD>~3 :>)* v _oD>Kg N>O=I9 F>qUxv /2GG>!B zY;>u:m P>q_Y~ 0><[cZUg^> Y>kX>M H[>: />58d% >jtm}S )>6{1n r Vr.>T +f)>0' ;H9>&X *StO9>T n03>Pu K~Je#>! bp(=>?g BC?>6t9^ c:> K&>.yC .xJ>Hf y\PD>! |b=})> c [1>H' uzKs@> 3>N;kU kE>fvw V6E>`"(5 RSDSFv LLD PDB. chrome_proxy.exe.pdb chrome_proxy.exe GetHandleVerifier CreateProcessAsUserW EventRegister EventUnregister EventWrite RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036 SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CompareStringW CreateEventW CreateFileW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnv"38:T508,file/memory contains long string with (Indicator: "VirtualFree"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CreateThread"; Source: "sample.bin"), file/memory contains long string with (Indicator: "VirtualAlloc"; Source: "sample.bin"), file/memory contains long string with (Indicator: "VirtualAllocEx"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WriteProcessMemory"; Source: "sample.bin"), file/memory contains long string with (Indicator: "NtMapViewOfSection"; Source: "sample.bin"), file/memory contains long string with (Indicator: "AllocateVirtualMemory"; Source: "sample.bin"), file/memory contains long string with (Indicator: "FreeMemory"; Source: "sample.bin"), Found reference to API "../..\base/allocator/partition_allocator/page_allocator_internals_win.h(145) Check failed: VirtualFree(reinterpret_cast(address), length, MEM_DECOMMIT)" (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API "../..\base/allocator/partition_allocator/page_allocator_internals_win.h(123) Check failed: VirtualFree(reinterpret_cast(address), 0, MEM_RELEASE)" (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "sample.bin")39:T4de,file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WaitForSingleObjectEx"; Source: "sample.bin"), file/memory contains long string with (Indicator: "NtWaitForSingleObject"; Source: "sample.bin"), file/memory contains long string with (Indicator: "NtQuerySystemInformation"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SleepEx"; Source: "sample.bin"), file/memory contains long string with (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), file/memory contains long string with (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetTimer"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WaitForMultipleObjectsEx"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "sample.bin")3a:Te4a,Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "sample.bin"), Found reference to API "bled-by-default-viz.surface_lifetime disabled-by-default-viz.triangles disabled-by-default-webaudio.audionode disabled-by-default-webrtc disabled-by-default-worker.scheduler disabled-by-default-xr.debug object_count objects Malloc PartitionAlloc.AddressSpace 0x%llx ThreadLocalEventBuffer tracing/thread_%d TraceLog tracing/main_trace_log event_name_allowlist filter_config.GetArgAsSet("event_name_allowlist", &*allowlist) ../../base/trace_event/trace_log.cc new_filter Unknown trace filter SetDisabledWhileLocked [0;3%dm (%.3f ms) number num_cpus sort_index process_sort_index process_labels thread_sort_index overflowed_at_ts trace_buffer_overflowed FindRunningChromeWindow AttemptToNotifyRunningChrome AttemptToNotifyRunningChrome:GetWindowThreadProcessId failed AttemptToNotifyRunningChrome:GetCurrentDirectory failed AttemptToNotifyRunningChrome:SendMessage AttemptToNotifyRunningChrome:Error SendFailed AttemptToNotifyRunningChrome:Error RemoteDied AttemptToNotifyRunningChrome:Error RemoteHung ::SHGetSpecialFolderP" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "edWritingCrashReport failed ../../third_party/crashpad/crashpad/client/prune_crash_reports.cc PruneCrashReportDatabase: Failed to get pending reports PruneCrashReportDatabase: Failed to get completed reports Database Pruning: Failed to remove report ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc GetFileInformationByHandleEx pipe != INVALID_HANDLE_VALUE CreateNamedPipe thread_handles[i].is_valid() CreateThread forged shutdown request, got: unhandled message type: unexpected version. got: expecting: forged client pid, real pid: , got: ImpersonateNamedPipeClient RevertToSelf() failed to open ConnectNamedPipe RegisterWaitForSingleObject crash dump requested RegisterWaitForSingleObject non-crash dump requested RegisterWaitForSingleObject process end ::GetNamedPipeClientProcessId ../../third_party/crashpad/crashpad/util/win/session_end_watcher.cc PostMessage WaitForSingleObject RegisterClass CreateWindow GetMessage GetWindowLongPtr SetWindowLongPtr UnregisterClass DestroyWindow .." (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "ersonateNamedPipeClient InitializeAcl InitializeSid IsValidSid LookupPrivilegeValueW MapGenericMask OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteValueW RegDisablePredefinedCache RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW RevertToSelf SetEntriesInAclW SetKernelObjectSecurity SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036 MiniDumpWriteDump SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW AllowSetForegroundWindow CloseDesktop CloseWindowStation CreateDesktopW CreateWindowExW CreateWindowStationW DefWindowProcW DestroyWindow DispatchMessageW FindWindowExW GetMessageW GetProcessWindowStation GetQueueStatus GetThreadDesktop GetUserObjectInformationW GetWindowLongPtrW GetWindowThreadProcessId IsWindow KillTimer MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW RegisterClassW SendMessageTimeoutW SetProcessDPIAware SetProcessWindowStation SetTimer SetWindowLongPtrW Translat" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "sample.bin"), Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "sample.bin")3b:T983,file/memory contains long string with (Indicator: "BuildExplicitAccessWithName"; Source: "sample.bin"), file/memory contains long string with (Indicator: "AccessCheck"; Source: "sample.bin"), file/memory contains long string with (Indicator: "AddMandatoryAce"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CreateRestrictedToken"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "DuplicateToken"; Source: "sample.bin"), file/memory contains long string with (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), file/memory contains long string with (Indicator: "EqualSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "FreeSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetAce"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetKernelObjectSecurity"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetLengthSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorDacl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorSacl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSidSubAuthority"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "sample.bin"), file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; Source: "sample.bin"), file/memory contains long string with (Indicator: "RevertToSelf"; Source: "sample.bin"), file/memory contains long string with (Indicator: "InitializeAcl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "InitializeSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "IsValidSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "MapGenericMask"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetKernelObjectSecurity"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetTokenInformation"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "DeriveCapabilitySidsFromName"; Source: "sample.bin")3c:T541,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetFileSize"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetFileVersionInfo"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetFileVersionInfoSize"; Source: "sample.bin"), file/memory contains long string with (Indicator: "QueryAttributesFile"; Source: "sample.bin"), file/memory contains long string with (Indicator: "QueryFullAttributesFile"; Source: "sample.bin"), Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "sample.bin"), Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSystemDirectory"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "sample.bin")3d:T428,file/memory contains long string with (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), file/memory contains long string with (Indicator: "QueryInformationProcess"; Source: "sample.bin"), Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "sample.bin"), Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "sample.bin")3e:T46a,file/memory contains long string with (Indicator: "WinHttpAddRequestHeaders"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WinHttpCloseHandle"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WinHttpConnect"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WinHttpCrackUrl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WinHttpOpen"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WinHttpReadData"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WinHttpReceiveResponse"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WinHttpSetTimeouts"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WinHttpWriteData"; Source: "sample.bin")3f:T426,Found string "gnature mismatch minidump version mismatch duplicate streams for type crashpad_info size mismatch crashpad_info version mismatch misc_info size mismatch module_list size mismatch module_crashpad_info_list size mismatch duplicate module_crashpad_info_list minidump_module_list_index memory_info_list size mismatch memory_list size mismatch thread_list size mismatch system info size mismatch Failed to read stream with ID 0x at index ../../third_party/crashpad/crashpad/handler/minidump_to_upload_parameters.cc duplicate key duplicate annotation name list_annotations ; filename="%s"%s Content-Type: %s%s multipart/form-data; boundary=%s Content-Type Content-Encoding ---MultipartBoundary- 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz %%%02x (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '/' || c == '.' || c == '_' || c == '+' || c == '-' ../../third_party/crashpad/crashpad/util/net/http_multipart_builder.cc --%s%sContent-Disposition: form-data; name="%s" ../.."; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"6aaf20d71b3fee590bd3e78dbf01ed31ef2a33e6278d6b83da79b9669e0311a9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794358908528,"unified_at":"2026-11-11T01:01:48.528Z","metadata":{"hashes":{"sha256":"6aaf20d71b3fee590bd3e78dbf01ed31ef2a33e6278d6b83da79b9669e0311a9","sha1":"7ed5bdc81250f741795b3831c59d2706e8e583a8","md5":"b412e41c7f6a11284d667cc16328c0bc"},"file_info":{"file_name":"6aaf20d71b3fee590bd3e78dbf01ed31ef2a33e6278d6b83da79b9669e0311a9","file_type":["peexe","executable"],"file_type_id":"exe","file_size":675577,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794358890000,"last_seen":1794358891000,"last_multi_scan":1794358891000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":52},"sandbox_signatures":{"informative_count":101,"suspicious_count":1,"malicious_count":2,"total":104},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Downloader.82973","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Small","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Downloader.TH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Adware.Zusy.311321","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Fugrafa-9733007-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Adware.Zusy.311321 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.UY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Suspicious:Backdoor.Small.ml.fqn.mg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Small.ka!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Agent.kx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005c160d1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Small.tpRp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_check_for_sandbox_and_av_modules","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-BBZI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXVQ-ZN!B412E41C7F6A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.IRHR-2426","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Click.DWD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Agent.ve","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Small.Win32.11061","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Adware.Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate a named-pipe client application (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"../..\\base/allocator/partition_allocator/page_allocator_internals_win.h(108) Check failed: static_cast(ERROR_SUCCESS) == GetLastError()\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"$37","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"file/memory contains long string with (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"CommandLineToArgv\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"file/memory contains long string with (Indicator: \"CreateThread\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"OpenThread\"; Source: \"sample.bin\"), Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SuspendThread\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ResumeThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"EnumDeviceDrivers\" (Indicator: \"EnumDeviceDrivers\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; Source: \"sample.bin\"), Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"RegDisablePredefinedCache\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"CreateFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtCreateFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtOpenFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtOpenProcess\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetProcessHeaps\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"file/memory contains long string with (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\"), Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\", Found registry modification API: \"RegCreateKey (in long string)\" in \"sample.bin\", Found registry modification API: \"RegCreateKeyA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$38","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"file/memory contains long string with (Indicator: \"CreateRemoteThread\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"RtlCreateUserThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-79","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"file/memory contains long string with (Indicator: \"CreateRemoteThread\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"OpenThread\"; Source: \"sample.bin\"), Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SuspendThread\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ResumeThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"file/memory contains long string with (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$39","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"file/memory contains long string with (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SetThreadToken\"; Source: \"sample.bin\"), Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"OpenThreadToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"file/memory contains long string with (Indicator: \"UnmapViewOfSection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.012","id":"string-90","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate a named-pipe client application (API string)","description":"file/memory contains long string with (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-165","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; Source: \"sample.bin\"), Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\"), Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"SHA512\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"VerifyVersionInfo\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"VerSetConditionMask\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"file/memory contains long string with (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\"), Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindWindow\"; Source: \"sample.bin\"), Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"file/memory contains long string with (Indicator: \"GetLocalTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"file/memory contains long string with (Indicator: \"GetDriveTypeW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1680","id":"string-998","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"file/memory contains long string with (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"EnumSystemLocales\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetUserDefaultLocaleName\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetUserDefaultLCID\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetSystemDefaultLCID\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetFileTime\"; Source: \"sample.bin\"), Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"file/memory contains long string with (Indicator: \"GetLocalTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"file/memory contains long string with (Indicator: \"GetDateFormat\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in \"sample.bin\", Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in \"sample.bin\", Found system information discovery API: \"QuerySystemInformation (in long string)\" in \"sample.bin\", Found system information discovery API: \"GetUserObjectInformation (in long string)\" in \"sample.bin\", Found system information discovery API: \"GetNativeSystemInfo (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"FreeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3a","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-906","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-659","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-907","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"file/memory contains long string with (Indicator: \"FindWindowExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"file/memory contains long string with (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"file/memory contains long string with (Indicator: \"GetUserDefaultLangID\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3b","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetProcessMitigationPolicy\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-402","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"file/memory contains long string with (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.002","id":"string-168","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetInformationFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtSetInformationFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValue (in long string)\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\", Found registry deletion API: \"NtDeleteKey (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"/c del \"\" (Indicator: \"/c del \") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-408","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3c","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"chacha\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegEnumValueW\" in \"sample.bin\", Found registry query API: \"RegQueryValue (in long string)\" in \"sample.bin\", Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"NtEnumerateKey (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3d","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"file/memory contains long string with (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindNextFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-122","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtQueryObject\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetUserName\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WTSQuerySessionInformation\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"file/memory contains long string with (Indicator: \"QueryDosDevice\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-227","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"file/memory contains long string with (Indicator: \"GetProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-478","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"file/memory contains long string with (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"file/memory contains long string with (Indicator: \"--user-data-dir\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-794","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"file/memory contains long string with (Indicator: \"dbghelp.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"file/memory contains long string with (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"file/memory contains long string with (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\"), Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-539","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"HttpSendRequest\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WinHttpConnect\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WinHttpOpenRequest\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WinHttpSendRequest\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WinHttpReadData\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WinHttpQueryHeaders\"; Source: \"sample.bin\"), Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\"), Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-736","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"crbug.com/1225176\", Pattern match: \"https://crashpad.chromium.org/\", Heuristic match: \"../../base/allocator/partition_allocator/starscan/stats_collector.cc\", Pattern match: \"extensions.database.open/0x\", Heuristic match: \"../../chrome/chrome_proxy/chrome_proxy_main_win.cc\", Heuristic match: \"../../base/allocator/partition_allocator/partition_alloc_base/rand_util_win.cc\", Heuristic match: \"../../third_party/perfetto/src/protozero/field.cc\", Heuristic match: \"../../third_party/perfetto/src/protozero/scattered_heap_buffer.cc\", Heuristic match: \"../../third_party/abseil-cpp/absl/types/bad_variant_access.cc\", Heuristic match: \"../../third_party/abseil-cpp/absl/types/bad_optional_access.cc\", Heuristic match: \"../../third_party/abseil-cpp/absl/base/internal/low_level_alloc.cc\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreateNamedPipe\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ConnectNamedPipe\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetNamedPipe\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"PeekNamedPipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$3e","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-323","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"file/memory contains long string with (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-537","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://crashpad.chromium.org\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" shutdown \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"sample.bin\"), Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"sample.bin\"), Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-241","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$3f","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-511","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"file/memory contains long string with (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1021.001","id":"string-436","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"file/memory contains long string with (Indicator: \"WTSQuerySessionInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-546","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"file/memory contains long string with (Indicator: \"CreateMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"file/memory contains long string with (Indicator: \"CreateWindowStation\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CreateDesktop\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-541","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 6aaf20d71b3f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6aaf20d71b3f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/27 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6aaf20d71b3fee590bd3e78dbf01ed31ef2a33e6278d6b83da79b9669e0311a9"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 6aaf20d71b3f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6aaf20d71b3f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/27 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6aaf20d71b3fee590bd3e78dbf01ed31ef2a33e6278d6b83da79b9669e0311a9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 6aaf20d71b3f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6aaf20d71b3f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/27 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L40","11",{}]] 32:null