21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Autoruns.Generic Sample 6d874c9aa367… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6d874c9aa367…. Malware family: Trojan.Autoruns.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529","keywords":["Malicious","Trojan.Autoruns.Generic","malware analysis","sandbox report","threat intelligence","6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529"],"about":{"@type":"SoftwareApplication","name":"octet-stream","applicationCategory":["peexe","assembly","executable"],"identifier":"6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Autoruns.Generic","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T50f,"" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00008358-00001420-0000010C-89915906 "" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00008358-00001420-0000010C-90009272 "" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll" at 00008358-00001420-0000010C-90026156 "" queries volume information of "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\1514fe39525a996edf8cc13445f5294a\System.EnterpriseServices.Wrapper.dll" at 00008358-00001420-0000010C-90028674 "" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll" at 00008358-00001420-0000010C-90032353 "" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll" at 00008358-00001420-0000010C-9003254123:T5ed,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\fb36278a0a934ae244f843b62229421c\System.Windows.Forms.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\3c20a6b0ca532bcc6271bf4b7ad0b4d9\System.Drawing.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\b9463297e0537784be981f4d68498abc\System.Data.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" "" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "" touched file "C:\Windows\System32\tzres.dll"24:T8bc,Found dropped filename "6AlN.txt.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "o3arG2g8N.mp3.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "O9ovIg2bIYnnkn.jpg.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "49ZUrTpJop.txt.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "2VNXsqpCLh.jpg.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "UfrS9fTjw3.pdf.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "4SNFg5oLaELI1.jpg.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "Lcqwv9Ym.pdf.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "uZUJptoFt.mp3.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "JUUv.jpg.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "reMzStfFD8mRor.mp3.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "dB9sFxN11kt.mp3.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "Ga6yUQG6vFAz.pdf.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "5r3OOF8fnCr7PI.txt.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "tr77VsAcglkHC.txt.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "Penguins.jpg.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "juJVZ1TS.jpg.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "sIBIw2qW.mp3.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "64D1N4.mp3.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "OnLvr1OcwDc3L.mp3.enc" which has been seen in the context of ransomware (Indicator: .ENC)25:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790654131713,"unified_at":"2026-09-29T03:55:31.713Z","metadata":{"hashes":{"sha256":"6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529","sha1":"0d80a4411d60abea0e355f8428ee7afee29735b7","md5":"3944a5cef4ba7955496e1e94a658bb65","sha512":"70efc986e9931a9060b8dea11e7cf9a7c5d6d0939a5e3e83cfa7aa6d793931cc24afc0310720c43eead648cb623972ea4e0b628409cf825319744c5bd21fa8bf","ssdeep":"192:EOxL5CGf3I7qcFJTt3mwAHlaXqGevA38s3fgbxU1fEqkexIzz1fOmCzpqDG0ji:EOUzTt3RAsqGcA38sgmE4qfOFoD9j","ssdeep_chunks":["192:EOxL5CG","192:OxL5CGf","192:xL5CGf3","192:L5CGf3I","192:5CGf3I7","192:CGf3I7q","192:Gf3I7qc","192:f3I7qcF","192:3I7qcFJ","192:I7qcFJT","192:7qcFJTt","192:qcFJTt3","192:cFJTt3m","192:FJTt3mw","192:JTt3mwA","192:Tt3mwAH","192:t3mwAHl","192:3mwAHla","192:mwAHlaX","192:wAHlaXq","192:AHlaXqG","192:HlaXqGe","192:laXqGev","192:aXqGevA","192:XqGevA3","192:qGevA38","192:GevA38s","192:evA38s3","192:vA38s3f","192:A38s3fg","192:38s3fgb","192:8s3fgbx","192:s3fgbxU","192:3fgbxU1","192:fgbxU1f","192:gbxU1fE","192:bxU1fEq","192:xU1fEqk","192:U1fEqke","192:1fEqkex","192:fEqkexI","192:EqkexIz","192:qkexIzz","192:kexIzz1","192:exIzz1f","192:xIzz1fO","192:Izz1fOm","192:zz1fOmC","192:z1fOmCz","192:1fOmCzp","192:fOmCzpq","192:OmCzpqD","192:mCzpqDG","192:CzpqDG0","192:zpqDG0j","192:pqDG0ji","384:EOxL5CG","384:OxL5CGf","384:xL5CGf3","384:L5CGf3I","384:5CGf3I7","384:CGf3I7q","384:Gf3I7qc","384:f3I7qcF","384:3I7qcFJ","384:I7qcFJT","384:7qcFJTt","384:qcFJTt3","384:cFJTt3m","384:FJTt3mw","384:JTt3mwA","384:Tt3mwAH","384:t3mwAHl","384:3mwAHla","384:mwAHlaX","384:wAHlaXq","384:AHlaXqG","384:HlaXqGe","384:laXqGev","384:aXqGevA","384:XqGevA3","384:qGevA38","384:GevA38s","384:evA38s3","384:vA38s3f","384:A38s3fg","384:38s3fgb","384:8s3fgbx","384:s3fgbxU","384:3fgbxU1","384:fgbxU1f","384:gbxU1fE","384:bxU1fEq","384:xU1fEqk","384:U1fEqke","384:1fEqkex","384:fEqkexI","384:EqkexIz","384:qkexIzz","384:kexIzz1","384:exIzz1f","384:xIzz1fO","384:Izz1fOm","384:zz1fOmC","384:z1fOmCz","384:1fOmCzp","384:fOmCzpq","384:OmCzpqD","384:mCzpqDG","384:CzpqDG0","384:zpqDG0j","384:pqDG0ji","192:EOUzTt3","192:OUzTt3R","192:UzTt3RA","192:zTt3RAs","192:Tt3RAsq","192:t3RAsqG","192:3RAsqGc","192:RAsqGcA","192:AsqGcA3","192:sqGcA38","192:qGcA38s","192:GcA38sg","192:cA38sgm","192:A38sgmE","192:38sgmE4","192:8sgmE4q","192:sgmE4qf","192:gmE4qfO","192:mE4qfOF","192:E4qfOFo","192:4qfOFoD","192:qfOFoD9","192:fOFoD9j"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"octet-stream","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":15360,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1517284823000,"last_seen":1654982337000,"last_multi_scan":1654982337000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":9,"malicious_count":3,"total":29},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/MSIL.Paggalangrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1203255","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Autoruns.GenericKD.41891924","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Agent.DKNX-1171","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Autoruns.GenericKD.41891924 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.LL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/MSIL.Mindlost.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.FileCrypter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005254851 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.qwfqbk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.cza","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ransom.exhpfz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Cryptear-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.D4F77C4B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.D4F77C4B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ransomer.POU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Autoruns.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"/Users/danielohayon/Documents/MindLost/MindLost/MindLost/Encryptor/obj/Debug/Encryptor.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a6febc07ca3e129932a1433"},{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"INSERT INTO victimsTable([UUID], [Key], Status) VALUES ('{0}','{1}',-1);\"\n \"DELETE FROM victimsTable WHERE UUID='{0}';\"","origin":"File/Memory","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"5a6febc07ca3e129932a1433"},{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://image.ibb.co/kO6xZ6/insane_uriel_by_urielstock_4.jpg\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a6febc07ca3e129932a1433"},{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529.exe.bin\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a6febc07ca3e129932a1433"},{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"VMware\" (Indicator: \"vmware\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5a6febc07ca3e129932a1433"},{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"19/65 Antivirus vendors marked sample as malicious (29% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a6febc07ca3e129932a1433"},{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"19/65 Antivirus vendors marked sample as malicious (29% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a6febc07ca3e129932a1433"},{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT UUID FROM Win32_ComputerSystemProduct\"","origin":"API Call","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$22","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"victimssqlserver.database.windows.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\.net data provider for sqlserver\"\n \"Global\\.net data provider for sqlserver\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll\" at 680A0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"\"cmd\" /c SYSTEMINFO\" on 2018-2-7.18:51:00.592\n \"\"cmd\" /c wmic csproduct get UUID\" on 2018-2-7.18:58:00.206","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"\"cmd\" /c SYSTEMINFO\" (UID: 00020085-00002952)\n Spawned process \"systeminfo.exe\" (UID: 00020088-00001816)\n Spawned process \"cmd.exe\" with commandline \"\"cmd\" /c wmic csproduct get UUID\" (UID: 00020509-00002112)\n Spawned process \"WMIC.exe\" with commandline \"wmic csproduct get UUID\" (UID: 00020511-00002948)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"WMIC.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"6AlN.txt.enc\" has type \"data\"\n \"o3arG2g8N.mp3.enc\" has type \"data\"\n \"O9ovIg2bIYnnkn.jpg.enc\" has type \"data\"\n \"49ZUrTpJop.txt.enc\" has type \"data\"\n \"2VNXsqpCLh.jpg.enc\" has type \"data\"\n \"UfrS9fTjw3.pdf.enc\" has type \"data\"\n \"4SNFg5oLaELI1.jpg.enc\" has type \"data\"\n \"Lcqwv9Ym.pdf.enc\" has type \"data\"\n \"uZUJptoFt.mp3.enc\" has type \"data\"\n \"JUUv.jpg.enc\" has type \"data\"\n \"reMzStfFD8mRor.mp3.enc\" has type \"data\"\n \"dB9sFxN11kt.mp3.enc\" has type \"data\"\n \"Ga6yUQG6vFAz.pdf.enc\" has type \"data\"\n \"5r3OOF8fnCr7PI.txt.enc\" has type \"data\"\n \"tr77VsAcglkHC.txt.enc\" has type \"data\"\n \"Penguins.jpg.enc\" has type \"data\"\n \"juJVZ1TS.jpg.enc\" has type \"data\"\n \"sIBIw2qW.mp3.enc\" has type \"data\"\n \"64D1N4.mp3.enc\" has type \"data\"\n \"OnLvr1OcwDc3L.mp3.enc\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$23","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"systeminfo.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00008358-00001420-00000105-90043251\n \"systeminfo.exe\" at 00020088-00001816-00000105-86748424\n \"WMIC.exe\" at 00020511-00002948-00000105-88476081","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"systeminfo.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWSENC\"; Value: \"\"C:\\6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"$24","origin":"Binary File","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"root\\cimv2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic csproduct get UUID\" (UID: 00020511-00002948)","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"systeminfo.exe\" wrote bytes \"c04e9b7720549c77e0659c77b5389d770000000000d0887600000000c5ea88760000000088ea887600000000e9688d7582289d77ee299d7700000000d2698d75000000007dbb88760000000009be8d7500000000ba18887600000000\" to virtual address \"0x773B1000\" (part of module \"NSI.DLL\")\n \"WMIC.exe\" wrote bytes \"c04e9b7720549c77e0659c77b5389d770000000000d0887600000000c5ea88760000000088ea887600000000e9688d7582289d77ee299d7700000000d2698d75000000007dbb88760000000009be8d7500000000ba18887600000000\" to virtual address \"0x773B1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00008358-00001420)\n Spawned process \"cmd.exe\" with commandline \"\"cmd\" /c SYSTEMINFO\" (UID: 00020085-00002952)\n Spawned process \"systeminfo.exe\" (UID: 00020088-00001816)\n Spawned process \"cmd.exe\" with commandline \"\"cmd\" /c wmic csproduct get UUID\" (UID: 00020509-00002112)\n Spawned process \"WMIC.exe\" with commandline \"wmic csproduct get UUID\" (UID: 00020511-00002948)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Executes WMI queries known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":99,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":49,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Sample Crashed","Sample not shared","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a79dc117ca3e147d437fdd3","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529_3944a5cef4ba7955496e1e94a658bb65","analysis_start_time":"2018-02-07T16:24:14+00:00","indicators_count":{"informative":17,"suspicious":14,"malicious":4},"tags":["Network Traffic","Extracted Files","Sample Crashed","Sample not shared"],"is_in_unified_schema":true},{"id":"5a71d41a7ca3e148782c8878","environment_id":120,"environment_description":"Windows 7 64 bit","state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"OTX_6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529","analysis_start_time":"2018-01-31T14:35:06+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5a6febc07ca3e129932a1433","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":65,"malware_family":"Trojan.Generic","submit_name":"octet-stream","analysis_start_time":"2018-01-30T04:51:15+00:00","indicators_count":{"informative":4,"suspicious":1,"malicious":3},"tags":["Sample Crashed","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"victimssqlserver.database.windows.net","address":"40.68.37.158","country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_creation_date":"1995-08-10T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}],"processes":[{"pid":1420,"ppid":0,"name":"6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529.exe","command_line":"","sha256":"6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529","normalized_path":"C:\\6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529.exe","uid":"00008358-00001420","icon":"$25"},{"pid":2952,"ppid":1420,"name":"cmd.exe","command_line":"\"cmd\" /c SYSTEMINFO","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00008358-00001420","uid":"00020085-00002952"},{"pid":1816,"ppid":2952,"name":"systeminfo.exe","command_line":"","sha256":"dce2c5ea1da23e63eeff2620141fbc2ca45fc4a64f40af89e722f4b5fafed27c","normalized_path":"%WINDIR%\\System32\\systeminfo.exe","parent_uid":"00020085-00002952","uid":"00020088-00001816"},{"pid":2112,"ppid":1420,"name":"cmd.exe","command_line":"\"cmd\" /c wmic csproduct get UUID","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00008358-00001420","uid":"00020509-00002112"},{"pid":2948,"ppid":2112,"name":"WMIC.exe","command_line":"wmic csproduct get UUID","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00020509-00002112","uid":"00020511-00002948"}],"all_imported_dlls":["msvcrt.dll","sechost.dll","rpcrt4.dll","ntdll.dll","mscoree.dll","kernel32.dll","KernelBase.dll","advapi32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","clr.dll","api-ms-win-core-xstate-l2-1-0.dll","oleaut32.dll","System.Xml.ni.dll","rasadhlp.dll","bcrypt.dll","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","usp10.dll","System.Windows.Forms.ni.dll","mswsock.dll","clbcatq.dll","msxml3.dll","System.Core.ni.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","sxs.dll","user32.dll","msasn1.dll","wship6.dll","wmi2xml.dll","WSHTCPIP.DLL","clrjit.dll","System.Configuration.ni.dll","wbemprox.dll","lpk.dll","System.Data.dll","crypt32.dll","shell32.dll","wshqos.dll","fastprox.dll","msvcr90.dll","System.Transactions.ni.dll","security.dll","bcryptprimitives.dll","mpr.dll","ntdsapi.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","profapi.dll","tzres.dll","rsaenh.dll","sspicli.dll","shlwapi.dll","System.ni.dll","nlssorting.dll","winnsi.dll","FWPUCLNT.DLL","wbemsvc.dll","urlmon.dll","mscoreei.dll","msvcr120_clr0400.dll","ole32.dll","System.Drawing.ni.dll","ws2_32.dll","System.EnterpriseServices.Wrapper.dll","ncrypt.dll","cryptbase.dll","dnsapi.dll","System.Runtime.Caching.ni.dll","winbrand.dll","iertutil.dll","userenv.dll","uxtheme.dll","imm32.dll","msctf.dll","nsi.dll","RpcRtRemote.dll","wbemcomn.dll","mlang.dll","gdi32.dll","apphelp.dll","System.Data.ni.dll","System.Transactions.dll","secur32.dll","schannel.dll","IPHLPAPI.DLL","msxml3r.dll","credssp.dll","framedynos.dll","wtsapi32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wininet.dll","MSOXMLMF.DLL","vbscript.dll","version.dll","mscorlib.ni.dll","rpcss.dll","System.EnterpriseServices.ni.dll","cryptsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"4SNFg5oLaELI1.jpg.enc","sha256":"d202b8419d11ed9c77582d6308e0dcc411056fa05824c8499d882a5f0bf0a283","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"64D1N4.mp3.enc","sha256":"d202b8419d11ed9c77582d6308e0dcc411056fa05824c8499d882a5f0bf0a283","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"6AlN.txt.enc","sha256":"677f0e547acb2e0e25dd0d93093a78f327996ddd67e1ab5ab13de5e421835a73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"o3arG2g8N.mp3.enc","sha256":"1444f88b0af496eb475207100f70da8894e23c946a31b5455358b5c393917eba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"O9ovIg2bIYnnkn.jpg.enc","sha256":"d202b8419d11ed9c77582d6308e0dcc411056fa05824c8499d882a5f0bf0a283","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"49ZUrTpJop.txt.enc","sha256":"cec83530df7bf27a6c4029160628d20bb27ba57867d8e58043467b0cbe838002","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"2VNXsqpCLh.jpg.enc","sha256":"79c1abd499f21efc4cbacdaaab3fae6582d4d62d57e35b821fbb811e7da47718","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"UfrS9fTjw3.pdf.enc","sha256":"b90c62e18ea6ec3f136a33f69956a3e55cc3ce43f673237281a1555e123c5d7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"Lcqwv9Ym.pdf.enc","sha256":"f7e3f3841e8fea6576ff530a52ab42ee3e59d22f114cf7a0f23f8e6ab7b74be3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"uZUJptoFt.mp3.enc","sha256":"77b0babce7a960fe8840d88a11229fe6b38c97d8652c88132febac847e634a38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"JUUv.jpg.enc","sha256":"e805bd12737cbd42d21bcf2e1cfccc41a39ccedf8336a0be7412eb71f9a79e75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"reMzStfFD8mRor.mp3.enc","sha256":"e9f826cc3471eb53188dfa0de8f6e768b946e681d2d643050cde248a9b9c6907","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"dB9sFxN11kt.mp3.enc","sha256":"e8984dca19fdbec946bff55feb5e82db9d6c1f884b2eba6c65a67f21f0a0bd45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"Ga6yUQG6vFAz.pdf.enc","sha256":"01195905793f6c8eedcb79de28058dd533447c48aee35b3d90a24216ffa8a09d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"5r3OOF8fnCr7PI.txt.enc","sha256":"734da78ece92ff6adc98ed9af4c43d1730eba86cca8171f8a42c62be4dd19b78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"tr77VsAcglkHC.txt.enc","sha256":"08ff8adb593ae2e99d81218a8763022b0af0907cfa088bd72e185e33dd5eda4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"Penguins.jpg.enc","sha256":"e465e09543eae8d635871e620d33c7cb140b578183e9eb2706a7793e8e1eb7e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"juJVZ1TS.jpg.enc","sha256":"140523ec0b68bbcbead5bcd8491eae3fd4c2b3a12b32ccd8763a80b82558b831","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"sIBIw2qW.mp3.enc","sha256":"419430c610e49f735a6d4946e7692a75438c962759a2915ef9fcbe21792845f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"OnLvr1OcwDc3L.mp3.enc","sha256":"883762af304a51a0dae7dab94b6872816427f190d98bb87a240601996e34e33e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"C:\\6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529.exe.config","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"C:\\6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529.exe","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\pubpol109.dat","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\7aa0dcace3b5d10b626540709537d280\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\0b2f69b43a576b9edcc807a30872bd91\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb36278a0a934ae244f843b62229421c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\3c20a6b0ca532bcc6271bf4b7ad0b4d9\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\systeminfo.exe","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\en-US\\systeminfo.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\mlang.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\wbem\\texttable.xsl","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Data\\b9463297e0537784be981f4d68498abc\\System.Data.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll.config","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\ce9750286ad44cbfb2acf176df9df0a2\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\bf505bb2c2b60e7a40740888cd2c3172\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\99115ffd380c2b2369d6a9e76b33f5d9\\System.Transactions.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll.config","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Ente96d83b35#\\1514fe39525a996edf8cc13445f5294a\\System.EnterpriseServices.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\System.EnterpriseServices\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.EnterpriseServices.Wrapper.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\System.EnterpriseServices\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.EnterpriseServices.Wrapper.dll.config","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\WSHTCPIP.DLL","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt19c51595#\\833669a3e273f016caa4a4ff7e742358\\System.Runtime.Caching.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net data provider for sqlserver","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]},{"name":"Global\\.net data provider for sqlserver","sources":[{"report_type":"sandbox","report_id":"5a79dc117ca3e147d437fdd3"}]}]}},"report_ids":{"sandbox_job_ids":["5a79dc117ca3e147d437fdd3","5a6febc07ca3e129932a1433"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Autoruns.Generic Sample 6d874c9aa367… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6d874c9aa367…. Malware family: Trojan.Autoruns.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Autoruns.Generic Sample 6d874c9aa367… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6d874c9aa367…. Malware family: Trojan.Autoruns.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6d874c9aa367238b39176467cb1677366a2735a2dfbcce4ff69ebd67ed3ab529"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Autoruns.Generic Sample 6d874c9aa367… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6d874c9aa367…. Malware family: Trojan.Autoruns.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L26","11",{}]]