34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3a:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious EXP/W64.MalwareX Sample 6d4bb18b6ee4… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 6d4bb18b6ee4…. Malware family: EXP/W64.MalwareX. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6d4bb18b6ee41e425f9fbda46e99f4c71f97b90f9e7f22d4ed67fcbc83270ee9","keywords":["Suspicious","EXP/W64.MalwareX","malware analysis","sandbox report","threat intelligence","6d4bb18b6ee41e425f9fbda46e99f4c71f97b90f9e7f22d4ed67fcbc83270ee9"],"about":{"@type":"SoftwareApplication","name":"SystemInformer.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"6d4bb18b6ee41e425f9fbda46e99f4c71f97b90f9e7f22d4ed67fcbc83270ee9","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"EXP/W64.MalwareX","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4b0,Found reference to API (Indicator: "NtWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtWaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegReplaceKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegRestoreKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetKeySecurity"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegFlushKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegSaveKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKey"; Source: "sample.bin"), Found reference to API (Indicator: "NtReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "RegLoadKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKey"; Source: "sample.bin"), Found reference to API (Indicator: "NtWaitForMultipleObjects"; Source: "sample.bin")37:T519,"Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Nsi" in Source: sample.bin, "System\CurrentControlSet\Enum\" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Svchost" in Source: sample.bin, "Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: sample.bin, "System\CurrentControlSet\Control\Session Manager\Environment" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" in Source: sample.bin, "Software\Microsoft\Wbem\Scripting" in Source: sample.bin, "Software\Microsoft\Windows Kits\Installed Roots" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\SilentProcessExit" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\HostComputeService\VolatileStore\ComputeSystem" in Source: sample.bin, "System\CurrentControlSet\Services\Tcpip\Parameters" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin38:T44c,"Thanks to: wj32 - Wen Jia Liu dmex - Steven G jxy-s - Johnny Shaw ionescu007 - Alex Ionescu yardenshafir - Yarden Shafir Contributors - thank you for your additions! Donors - thank you for your support! System Informer uses the following components: PresentMon by Intel Corporation Mini-XML by Michael Sweet PCRE2 by Philip Hazel json-c by Michael Clark MD5 code by Jouni Malinen SHA1 code by Filip Navara, based on code by Steve Reid " (Indicator: "github.com"), " (