34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 53:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.GandCrab.Generic Sample 7572b5b6b1f0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7572b5b6b1f0…. Malware family: Ransom.GandCrab.Generic. Threat score 100/100. 21/25 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb","keywords":["Malicious","Ransom.GandCrab.Generic","malware analysis","sandbox report","threat intelligence","7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb"],"about":{"@type":"SoftwareApplication","name":"Documents-invoice-plan_032023.exe","applicationCategory":["peexe","executable"],"identifier":"7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.GandCrab.Generic","antivirusDetections":{"malicious":21,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4a9,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Documents-invoice-plan_032023.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Documents-invoice-plan_032023.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "&WaitForSingleObject@8" (Indicator: "WaitForSingleObject"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp")37:T194c,"Documents-invoice-plan_032023.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000775632f7a3831673d801ef02ec00587730f1ef0240b116739bd8c586feffffffa0f0ef023c74157350f0ef0208f1ef02000000005574157308f1ef02ffffffffffffffff230000000000000008f1ef02000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff230000000000000008f1ef02000000001c000000000000000000000000000000000000005f5632f740f1ef02 (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001808) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002616) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002616)38:Ta66,"Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")39:T5c9,"Documents-invoice-plan_032023.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "Documents-invoice-plan_032023.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")3a:T7a7,"Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001808) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002616) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002616) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002616) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002616)3b:T4f09,"Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00007536) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter ___lc_codepage_func (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter vsprintf_s (UID: 00000000-00001808) "Documents-invoice-plan_032023.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001808) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002616) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002616)3c:T4c98,Found reference to API (Indicator: "GetStdHandle"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "LocalAlloc"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "OpenFileMappingA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "SetStdHandle"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetCPInfo"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetStringTypeA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "WriteFile"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "EnumDateFormatsW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetOEMCP"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "FormatMessageW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetStringTypeExW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "TlsGetValue"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "SetLastError"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "HeapAlloc"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "FoldStringA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "DeleteTimerQueueTimer"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GlobalAddAtomA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "TerminateProcess"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "FindAtomA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "CallNamedPipeW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "HeapFree"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "SetHandleCount"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetTickCount"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "TlsAlloc"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "RtlUnwind"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetConsoleAliasesA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GlobalReAlloc"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetPrivateProfileSectionW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "CreateEventW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "OpenJobObjectW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetFileType"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "TlsSetValue"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "CreateFileA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "ExitProcess"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetLastError"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "LCMapStringW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "LCMapStringA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetBinaryTypeW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "HeapSize"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "lstrcpynW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "RaiseException"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "TlsFree"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "SetFilePointer"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "CloseHandle"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "EnumSystemCodePagesA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetACP"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "HeapCreate"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "VirtualFree"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "Sleep"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetMenuInfo"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "LoadMenuW"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "EncodePointer"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "DecodePointer"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "FlsFree"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "FlsSetValue"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "FlsGetValue"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "FlsAlloc"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "MessageBoxA"; File: "Documents-invoice-plan_032023.exe") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "AddAtomA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteAtom"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "FindAtomA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetAtomNameA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "SetProcessAffinityMask"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp")3d:T53d,Found string "%WINDIR%\system32\cmd.exe /c tzutil /g" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00001808-00000C43-5281380136") Found string "%WINDIR%\system32\cmd.exe /c tzutil /g" (Indicator: "cmd.exe /c"; Source: "00000000-00001808-00000C43-5281380136") Found string ":\WINDOWS\system32\cmd.exe /c tzutil /g" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c tzutil /g" (Indicator: "cmd.exe /c"; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found string "WS\system32\cmd.exe /c tzutil /g" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00001808.00000000.119481.02FE0000.00000004.mdmp, 00000000-00001808.00000001.121403.02FE0000.00000004.mdmp, 00000000-00001808.00000002.123320.02FE0000.00000004.mdmp") Found string "WS\system32\cmd.exe /c tzutil /g" (Indicator: "cmd.exe /c"; Source: "00000000-00001808.00000000.119481.02FE0000.00000004.mdmp, 00000000-00001808.00000001.121403.02FE0000.00000004.mdmp, 00000000-00001808.00000002.123320.02FE0000.00000004.mdmp")3e:T6a6,Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106." (Indicator: "mozilla/5.0 ("; Source: "00000000-00001808-00000C95-1286932580") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106." (Indicator: "mozilla/5.0 ("; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106." (Indicator: "user-agent: "; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp") Found string "User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106." (Indicator: "mozilla/5.0 ("; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106." (Indicator: "mozilla/5.0 ("; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.00400000.00000040.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found string "er-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106." (Indicator: "mozilla/5.0 ("; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp")3f:Tf1b,"Documents-invoice-plan_032023.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74240000 "Documents-invoice-plan_032023.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74240000 "Documents-invoice-plan_032023.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74240000 "Documents-invoice-plan_032023.exe" loaded module "KERNEL32" at base 74b30000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730f0000 "Documents-invoice-plan_032023.exe" loaded module "KERNEL32.DLL" at base 74b30000 "Documents-invoice-plan_032023.exe" loaded module "MSIMG32.DLL" at base 73080000 "Documents-invoice-plan_032023.exe" loaded module "USER32" at base 765d0000 "Documents-invoice-plan_032023.exe" loaded module "NTDLL.DLL" at base 77530000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a00000 "Documents-invoice-plan_032023.exe" loaded module "RPCRT4.DLL" at base 74040000 "Documents-invoice-plan_032023.exe" loaded module "SSPICLI.DLL" at base 73f50000 "Documents-invoice-plan_032023.exe" loaded module "USER32.DLL" at base 765d0000 "Documents-invoice-plan_032023.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72d90000 "Documents-invoice-plan_032023.exe" loaded module "WINHTTP.DLL" at base 72ce0000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72d90000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73200000 "Documents-invoice-plan_032023.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74b30000 "Documents-invoice-plan_032023.exe" loaded module "MSISO.DLL" at base 72c70000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72c60000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72c10000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 741c0000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72ba0000 "Documents-invoice-plan_032023.exe" loaded module "MSKEYPROTECT.DLL" at base 72b90000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74100000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72b00000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 73f70000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72ab0000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 72ab0000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74420000 "Documents-invoice-plan_032023.exe" loaded module "CRYPTNET.DLL" at base 72ab0000 "Documents-invoice-plan_032023.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72a90000 "Documents-invoice-plan_032023.exe" loaded module "WS2_32.DLL" at base 741c0000 "cmd.exe" loaded module "KERNEL32" at base 74b30000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74240000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74240000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74240000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76b50000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74240000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74240000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74240000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730f0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 74b30000 "cmd.exe" loaded module "NTDLL.DLL" at base 7753000040:T5fa,"Documents-invoice-plan_032023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")41:Td6a,"Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "DOCUMENTS-INVOICE-PLAN_032023.EXE"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "DOCUMENTS-INVOICE-PLAN_032023"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")42:T4e1,"Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\MSIMG32.DLL" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\msimg32.dll" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\WININET.DLL" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\iertutil.dll" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\URLMON.DLL" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\urlmon.dll" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\BCRYPT.DLL" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\bcrypt.dll" "Documents-invoice-plan_032023.exe" trying to access non-existent file "C:\DPAPI.DLL" "cmd.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"43:T1236,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001808-00000C29-870378965") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "19293996084,3664,3229,,InternetReadFile,Wininet.dll,"00:31:10.093",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "83671225802,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672720600,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672181164,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672589998,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672893138,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672100538,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83670796400,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83673024260,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83670928566,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83670325808,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83670869740,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672966460,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672836546,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672779502,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "155559474792,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "155559004766,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "155560652806,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp")44:T13d8,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "19293996084,3664,3229,,InternetReadFile,Wininet.dll,"00:31:10.093",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "83671225802,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672720600,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672181164,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672589998,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672893138,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672100538,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83670796400,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83673024260,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83670928566,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83670325808,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83670869740,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672966460,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672836546,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "83672779502,3664,3229,,InternetReadFile,Wininet.dll,"00:31:36.906",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found reference to API "155559474792,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "155559004766,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "155560652806,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "155558461692,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "155559606584,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "155558922594,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "155560274174,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "155559741198,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found reference to API "155558658092,3664,3229,,InternetReadFile,Wininet.dll,"00:32:06.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp")45:T4f5,"24.35.27.86" "64.124.12.162" "45.80.69.193" "5.80.69.193" Potential IP "45.80.69.193" found in string "ttp://45.80.69.193/glazomer/legit" Potential IP "45.80.69.193" found in string "ttp://45.80.69.193/register" Potential IP "45.80.69.193" found in string "ttp://45.80.69.193/" Potential IP "45.80.69.193" found in string "45.80.69.193/register" Potential IP "45.80.69.193" found in string "Host: 45.80.69.193" "2.5.29.31" "2.5.29.32" "2.5.29.15" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.17" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.14" "2.5.29.19" "193.69.80.45" "2.5.4.3" "2.5.29.1" "2.5.29.10" "2.5.29.16" Potential IP "45.80.69.193" found in string "http://45.80.69.193/" Potential IP "45.80.69.193" found in string "http://45.80.69.193/glazomer/legit" Potential IP "45.80.69.193" found in string "http://45.80.69.193/register" Potential IP "64.124.12.162" found in string ""{\"ip\": '64.124.12.162' \"UID\": '0x2c5fdfc' \"geo\": 'Pacific Standard Time' \"service\": 'google' \"owner_token\": 'tejkfh38y7y2dh2hjhs2jndk234d'}"" Potential IP "45.80.69.193" found in string "http://45.80.69.193/glazomer/payload" Potential IP "45.80.69.193" found in string "ttp://45.80.69.193/glazomer/payload"46:T1e6b,Heuristic match: "a).vg" Heuristic match: ";1.gs" Heuristic match: "8.xxx" Heuristic match: "del_opv.cc" Heuristic match: "eh_personality.cc" Heuristic match: "eh_terminate.cc" Heuristic match: "eh_throw.cc" Heuristic match: "eh_unex_handler.cc" Heuristic match: "new_opv.cc" Heuristic match: "tinfo.cc" Heuristic match: "vterminate.cc" Heuristic match: "ios_init.cc" Heuristic match: "locale.cc" Heuristic match: "locale_init.cc" Heuristic match: "numeric_members.cc" Heuristic match: "codecvt.cc" Heuristic match: "cow-locale_init.cc" Heuristic match: "cow-shim_facets.cc" Heuristic match: "cow-string-inst.cc" Heuristic match: "ctype.cc" Heuristic match: "ctype_members.cc" Heuristic match: "ext11-inst.cc" Heuristic match: "fstream-inst.cc" Heuristic match: "functexcept.cc" Heuristic match: "ios-inst.cc" Heuristic match: "ios.cc" Heuristic match: "iostream-inst.cc" Heuristic match: "istream-inst.cc" Heuristic match: "locale-inst.cc" Heuristic match: "ostream-inst.cc" Heuristic match: "random.cc" Heuristic match: "snprintf_lite.cc" Heuristic match: "streambuf-inst.cc" Heuristic match: "string-inst.cc" Heuristic match: "wlocale-inst.cc" Heuristic match: "wstring-inst.cc" Heuristic match: "bad_alloc.cc" Heuristic match: "bad_cast.cc" Heuristic match: "bad_typeid.cc" Heuristic match: "class_type_info.cc" Heuristic match: "del_op.cc" Heuristic match: "del_ops.cc" Heuristic match: "dyncast.cc" Heuristic match: "eh_alloc.cc" Heuristic match: "eh_aux_runtime.cc" Heuristic match: "eh_call.cc" Heuristic match: "eh_catch.cc" Heuristic match: "eh_exception.cc" Heuristic match: "eh_globals.cc" Heuristic match: "eh_term_handler.cc" Heuristic match: "eh_type.cc" Heuristic match: "guard.cc" Heuristic match: "new_handler.cc" Heuristic match: "new_op.cc" Heuristic match: "new_opvnt.cc" Heuristic match: "pure.cc" Heuristic match: "basic_file.cc" Heuristic match: "c++locale.cc" Heuristic match: "codecvt_members.cc" Heuristic match: "collate_members.cc" Heuristic match: "globals_io.cc" Heuristic match: "ios_locale.cc" Heuristic match: "istream.cc" Heuristic match: "locale_facets.cc" Heuristic match: "misc-inst.cc" Heuristic match: "stdexcept.cc" Heuristic match: "streambuf.cc" Heuristic match: "time_members.cc" Heuristic match: "cow-stdexcept.cc" Heuristic match: "cxx11-stdexcept.cc" Heuristic match: "sso_string.cc" Heuristic match: "system_error.cc" Heuristic match: "compatibility.cc" Heuristic match: "bad_array_new.cc" Heuristic match: "ios_failure.cc" Heuristic match: "ipinfo.io" Pattern match: "ipinfo.io/ip" Heuristic match: "pinfo.io" Pattern match: "http://www.bing.com/" Heuristic match: "ntrust.net" Pattern match: "https://ipinfo.io/ip" Heuristic match: "*.company.io" Heuristic match: "*.host.io" Heuristic match: "*.ipinfo.io" Heuristic match: "*.ipinfo.net" Heuristic match: "*.ipinfo.org" Heuristic match: "*.ipinfoio.com" Heuristic match: "*.useragent.io" Heuristic match: "company.io" Heuristic match: "host.io" Heuristic match: "ipinfo.net" Heuristic match: "ipinfo.org" Heuristic match: "ipinfoio.com" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Heuristic match: "|z|t.co" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Heuristic match: "host: ipinfo.io" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://45.80.69.193/" Pattern match: "crosoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/ce" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-0" Pattern match: "www.microsoft.com0" Pattern match: "http://45.80.69.193/glazomer/legit" Pattern match: "http://45.80.69.193/register" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "www.microsof3" Pattern match: "www.microsof%" Pattern match: "www.micr" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29" Pattern match: "http://45.80.69.193/glazomer/payload" Pattern match: "https://gcc.gnu.org/bugs/"47:T7b03,Found URL "http://www.bing.com/registerhapubws80.69.193/register45.80.69.193/registerftwa\microsoft\wins\zones\httphttpsfile@ivtshellknownfolderare\microsoft\systemcertificates\caerisign" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "https://ipinfo.io/ipusername=hapubwshttps://ipinfo.io/ipusername=hapubwsprocessor_revision=4f00processor_level=6sessionname=consolepublic=c:\users\publicprocessor_level=6processor_revision=4f00systemroot=c:\windowspath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "https://ipinfo.io/iphttps://ipinfo.io/iplmem" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc(jdp&" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eaucooe:j9_($nnew" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-0ya'4>@6t+a6" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://45.80.69.193/glazomer/legitrcertdllverifyrevocationhttp://45.80.69.193/glazomer/legithttp://45.80.69.193/glazomer/legithttp://45.80.69.193/glazomer/legitassm0tdwhttp://45.80.69.193/glazomer/legitk82245.80.69.193rptdwhttp://45.80.69.193/registerhttp://45.80.69.193/registerasycqqqqqqqqqqqqqqqq170531232859z180601232859z0.files-df.1drv.com1.files.1drv.com1.aadrm.com1&0.afx.ms1&0.akadns.net1&0.aspnetcdn.com1.azure-int.net1&0.azure-mobile.net1.azure.com1&0.cloudapp.azure.com1" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://www.microsof3i/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsof%i/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.micrm/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29." - Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found URL "http://45.80.69.193/glazomer/legitmsftser.exehttp://45.80.69.193/glazomer/payloadmsmpeng.exetzutil" - Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found URL "https://ipinfo.io/ipunknownc:\users\%s\appdata\roaming\%sc:\users\%s\appdata\roaming\%s\%svsprintf_sterminate" - Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found URL "https://gcc.gnu.org/bugs/):" - Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found URL "http://www.bing.com/registerftwa\microsoft\wins\zones\httphttpsfile@ivtshellknownfolderare\microsoft\systemcertificates\caerisign" - Source: "00000000-00001808.00000001.121403.02760000.00000004.mdmp") Found URL "https://ipinfo.io/ipusername=hapubwshttps://ipinfo.io/ipusername=hapubwsprocessor_revision=4f00processor_level=6sessionname=consolepublic=c:\users\publicprocessor_level=6processor_revision=4f00systemroot=c:\windowspath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00001808.00000001.121403.02760000.00000004.mdmp") Found URL "https://ipinfo.io/iphttps://ipinfo.io/iplmem" - Source: "00000000-00001808.00000001.121403.02760000.00000004.mdmp") Found URL "http://45.80.69.193/glazomer/payloadhttp://45.80.69.193/glazomer/payloadp-pep-pepauw(g" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc(jdp&" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eaucooe:j9_($nnew" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-0ya'4>@6t+a6" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://45.80.69.193/glazomer/payloadcertdllverifyrevocationhttp://45.80.69.193/glazomer/payloadhttp://45.80.69.193/glazomer/payloadassm0tdwhttp://45.80.69.193/glazomer/payloadk822rptdwhttp://45.80.69.193/registerhttp://45.80.69.193/registerasycqqqqqqqqqqqqqqqq170531232859z180601232859z0.files-df.1drv.com1.files.1drv.com1.aadrm.com1&0.afx.ms1&0.akadns.net1&0.aspnetcdn.com1.azure-int.net1&0.azure-mobile.net1.azure.com1&0.cloudapp.azure.com1" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://www.microsof3i/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsof%i/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.micrm/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29." - Source: "00000000-00001808.00000001.121403.027D5000.00000004.mdmp") Found URL "http://www.bing.com/registerftwa\microsoft\wins\zones\httphttpsfile@ivtshellknownfolderare\microsoft\systemcertificates\caerisign" - Source: "00000000-00001808.00000002.123320.02760000.00000004.mdmp") Found URL "https://ipinfo.io/ipusername=hapubwshttps://ipinfo.io/ipusername=hapubwsprocessor_revision=4f00processor_level=6sessionname=consolepublic=c:\users\publicprocessor_level=6processor_revision=4f00systemroot=c:\windowspath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00001808.00000002.123320.02760000.00000004.mdmp") Found URL "https://ipinfo.io/iphttps://ipinfo.io/iplmem" - Source: "00000000-00001808.00000002.123320.02760000.00000004.mdmp") Found URL "http://45.80.69.193/glazomer/payloadhttp://45.80.69.193/glazomer/payloadp-pep-pepauw(g" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc(jdp&" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eaucooe:j9_($nnew" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-0ya'4>@6t+a6" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://45.80.69.193/glazomer/payloadcertdllverifyrevocationhttp://45.80.69.193/glazomer/payloadhttp://45.80.69.193/glazomer/payloadassm0tdwhttp://45.80.69.193/glazomer/payloadk822rptdwhttp://45.80.69.193/registerhttp://45.80.69.193/registerasycqqqqqqqqqqqqqqqq170531232859z180601232859z0.files-df.1drv.com1.files.1drv.com1.aadrm.com1&0.afx.ms1&0.akadns.net1&0.aspnetcdn.com1.azure-int.net1&0.azure-mobile.net1.azure.com1&0.cloudapp.azure.com1" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://www.microsof3i/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsof%i/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.micrm/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29." - Source: "00000000-00001808.00000002.123320.027D5000.00000004.mdmp")48:T462,Found string "POST /register HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp") Found string "Content-Length155POST /register HTTP/1.1x-y" (Indicator: "HTTP/1.1"; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp") Found string "zomer/legit HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found string "GET /glazomer/legit HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found string "Host45.80.69.193GET /glazomer/legit HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001808.00000000.119481.02760000.00000004.mdmp") Found string "zomer/payload HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp")49:T54f,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Documents-invoice-plan_032023.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "Documents-invoice-plan_032023.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "Documents-invoice-plan_032023.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Documents-invoice-plan_032023.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "%GetModuleHandleW@4" (Indicator: "GetModuleHandle"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "&GetCurrentProcessId@0" (Indicator: "GetCurrentProcess"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW@4" (Indicator: "GetModuleHandle"; Source: "00000000-00001808.00000001.121403.00400000.00000040.mdmp")4a:T97b,"Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\DOCUMENTS-INVOICE-PLAN_032023.EXE"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "")4b:T8db,"Documents-invoice-plan_032023.exe" wrote 00000004 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 00000600 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 000CF200 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 00001C00 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 0000D000 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote to a remote process handle 384 "Documents-invoice-plan_032023.exe" wrote 00001200 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 00000200 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 00007000 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 00000A00 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 00020600 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 00005E00 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 0000FC00 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 00004200 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 00000C00 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 00016E00 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "Documents-invoice-plan_032023.exe" wrote 00001600 bytes to a remote process "C:\Documents-invoice-plan_032023.exe" (Handle: 384) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\tzutil.exe" (Handle: 388)4c:T7f2,"ipinfo.io" (Indicator: "ipinfo.io"; File: "PCAP") "ttps://ipinfo.io/ip" (Indicator: "ipinfo.io"; File: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp") "ipinfo.io" (Indicator: "ipinfo.io"; File: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp") "ttps://ipinfo.io/" (Indicator: "ipinfo.io"; File: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp") "https://ipinfo.io/ip" (Indicator: "ipinfo.io"; File: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.00400000.00000040.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp") "ipinfo.io0" (Indicator: "ipinfo.io"; File: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp") "*.ipinfo.io" (Indicator: "ipinfo.io"; File: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp") "Host: ipinfo.io" (Indicator: "ipinfo.io"; File: "00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp")4d:T7d8,Found string "\Device\HarddiskVolume3\Documents-invoice-plan_032023.exe" (Indicator: "\Device\"; Source: "00000000-00001940-00000BC0-4057177647") Found string "\Device\HarddiskVolume3\Windows\SysWOW64\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00009548-00000BC0-4059887661") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00002532-00000BC0-4059973319") Found string "\Device\HarddiskVolume3\Windows\SysWOW64\tzutil.exe" (Indicator: "\Device\"; Source: "00000000-00002532-00000BC0-4061217161") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00009548.00000000.323799.007B0000.00000004.mdmp, 00000000-00009548.00000000.323799.00B40000.00000004.mdmp, 00000000-00009548.00000001.325722.007B0000.00000004.mdmp, 00000000-00009548.00000001.325722.00B40000.00000004.mdmp, 00000000-00009548.00000002.327639.007B0000.00000004.mdmp, 00000000-00009548.00000002.327639.00B40000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00009548.00000000.323799.007B0000.00000004.mdmp, 00000000-00009548.00000000.323799.00B40000.00000004.mdmp, 00000000-00009548.00000001.325722.007B0000.00000004.mdmp, 00000000-00009548.00000001.325722.00B40000.00000004.mdmp, 00000000-00009548.00000002.327639.007B0000.00000004.mdmp, 00000000-00009548.00000002.327639.00B40000.00000004.mdmp") Found string "tC:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00009548.00000000.323799.00B40000.00000004.mdmp, 00000000-00009548.00000001.325722.00B40000.00000004.mdmp, 00000000-00009548.00000002.327639.00B40000.00000004.mdmp") Found string "tC:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00009548.00000000.323799.00B40000.00000004.mdmp, 00000000-00009548.00000001.325722.00B40000.00000004.mdmp, 00000000-00009548.00000002.327639.00B40000.00000004.mdmp")4e:T493,Contains base64 string in header "2FvRjdSfHXyEq3Tg" in header "GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgQP4sLiKCM%2FvRjdSfHXyEq3Tg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: r11.o.lencr.org" Contains base64 string in header "Keep" in header "GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgQP4sLiKCM%2FvRjdSfHXyEq3Tg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: r11.o.lencr.org" Contains base64 string in header "User" in header "GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgQP4sLiKCM%2FvRjdSfHXyEq3Tg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: r11.o.lencr.org" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: x1.c.lencr.org" Contains base64 string in header "User" in header "GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: x1.c.lencr.org"4f:Tb4a,"Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "Documents-invoice-plan_032023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")50:T539,"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgQP4sLiKCM%2FvRjdSfHXyEq3Tg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: r11.o.lencr.org" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "EEF5D277F173F405895BE4BF06B59726D067945D72727CEA5DE23373CA832DE2" Last-Modified: Tue 24 Dec 2024 07:54:00 UTC Cache-Control: public no-transform must-revalidate max-age=3240 Expires: Thu 26 Dec 2024 06:53:14 GMT Date: Thu 26 Dec 2024 05:59:14 GMT Connection: keep-alive with response body ==>308201F40A0100A08201ED308201E906092B0601050507300101048201DA308201D63081BFA1353033310B300906035504061302555331163014060355040A13....... "GET / HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: x1.c.lencr.org" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-crl Last-Modified: Fri 13 Dec 2024 18:01:23 GMT ETag: "675c7673-2de" Cache-Control: max-age=3600 Expires: Thu 26 Dec 2024 06:59:14 GMT Date: Thu 26 Dec 2024 05:59:14 GMT Content-Length: 734 Connection: keep-alive with response body ==>308202DA3081C3020101300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375.......51:T912,"cmd.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\*.* (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter aaclient.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter ACCTRES.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter acledit.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter aclui.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter acppage.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter acproxy.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter ActionCenter.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter ActionCenterCPL.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter ActionQueue.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter activeds.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter activeds.tlb (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter actxprxy.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter AdapterTroubleshooter.exe (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter AdmTmpl.dll (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter Adobe (UID: 00000000-00002964) "cmd.exe" called "FindNextFileW" with parameter adprovider.dll (UID: 00000000-00002964)52:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAD/////////////////AAAA////////j/////////AAAP/////////////////wAAAP/4//////+P//////8JCZmIiIiIiIiIiIiIj///CZmZmZd5d5mZeXmXeX///wmZmZmZmZmZmZmZmZmY//8JmZmZmZmXeZmZmZmZmP//CZmZmImZf/+Jf5mZmZj4/wmZmZiIiY+XiH95mZl4//+5mZmY+PiPmY9//4mZeP//CZmZmImIj5mIf4d5mXj//wmZmZiI+I+I+H+IiZl4//8JmZmYiImYiHmYiImZeP//CZmZmZmZmZmZmZmZmZ///wmZmZmZmZmZmZmZmZmY//8JmZmZl5eZeZeXmZl5j///CQmZiIiIiIiIiIiIiP///wAACI///////////////4gAAAj///////////////iIAACI//////////////+IiAAAiP////////j////4iIgAAIj/////////////iIiIgACI////////////+IiIiIAAAP///////4//+IiIiIiAAAD///////////iIiIiIAAAP///////////4iIiAgAAAD///////////+IiIAAAAAA////////////iIgAAAAAAP///////////4iAAAAAAAD///////////+IUAAAAAAA////////////hVAAAAD8AAAD+AAAAfgAAAH4AAABwAAAAYAAAAGAAAABgAAAAYAAAAGAAAAAgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAcAAAAHwAAAB8AAAAfAAAAHgAAAB4AAAAegAAAH4AAAD+AAAB/gAAA/4AAAf+AAAP/gAAH/4AAB//AAA/w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794023238315,"unified_at":"2026-11-07T03:47:18.315Z","metadata":{"hashes":{"sha256":"7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb","sha1":"bd43089a78e97b66064b37d72f086f4c042a4c91","md5":"82acd827f36e29c05e6581558b0d76ca","sha512":"cdf9077fb0c06a9fc38dc0aa630345adfb65bfb264d03d7b56b0961f02798f8bce49fcfa28fd40671a02e1e385ac0c4c2a3f914b1d0b64a844462be2127b261f","ssdeep":"24576:f/f6OAqD+EoVeQExeVATaXAuQ5x3f3TWH5x:faOAU+M/WH5x","ssdeep_chunks":["24576:f/f6OAq","24576:/f6OAqD","24576:f6OAqD+","24576:6OAqD+E","24576:OAqD+Eo","24576:AqD+EoV","24576:qD+EoVe","24576:D+EoVeQ","24576:+EoVeQE","24576:EoVeQEx","24576:oVeQExe","24576:VeQExeV","24576:eQExeVA","24576:QExeVAT","24576:ExeVATa","24576:xeVATaX","24576:eVATaXA","24576:VATaXAu","24576:ATaXAuQ","24576:TaXAuQ5","24576:aXAuQ5x","24576:XAuQ5x3","24576:AuQ5x3f","24576:uQ5x3f3","24576:Q5x3f3T","24576:5x3f3TW","24576:x3f3TWH","24576:3f3TWH5","24576:f3TWH5x","49152:f/f6OAq","49152:/f6OAqD","49152:f6OAqD+","49152:6OAqD+E","49152:OAqD+Eo","49152:AqD+EoV","49152:qD+EoVe","49152:D+EoVeQ","49152:+EoVeQE","49152:EoVeQEx","49152:oVeQExe","49152:VeQExeV","49152:eQExeVA","49152:QExeVAT","49152:ExeVATa","49152:xeVATaX","49152:eVATaXA","49152:VATaXAu","49152:ATaXAuQ","49152:TaXAuQ5","49152:aXAuQ5x","49152:XAuQ5x3","49152:AuQ5x3f","49152:uQ5x3f3","49152:Q5x3f3T","49152:5x3f3TW","49152:x3f3TWH","49152:3f3TWH5","49152:f3TWH5x","24576:faOAU+M","24576:aOAU+M/","24576:OAU+M/W","24576:AU+M/WH","24576:U+M/WH5","24576:+M/WH5x"],"imphash":"967eb4f66af509da0d8ad27d2261daaf"},"file_info":{"file_name":"Documents-invoice-plan_032023.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1577775,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1679095807000,"last_seen":1735192715000,"last_multi_scan":1735192715000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["aresloader","commodity","criminal","loader"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":67},"sandbox_signatures":{"informative_count":162,"suspicious_count":16,"malicious_count":7,"total":185},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.SmokeLoader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.GenKryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1374766","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.GandCrab.1249","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packer.pkr_ce1a-9980177-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Ransom_Win32_StopCrypt_SAL_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.GandCrab.1249 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HTBT trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.gen!D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"AresLoader.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.ktvjjx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-VK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/SmokeLoader.F.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.OQX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanBanker.Gozi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_45.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4081721","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.GandCrab.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","identifiers":[{"type":"suspicious","value":"Able to evade execution by checking for blacklisted external IPs"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Submission/internal name is suspicious for an executable"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Queries Windows time zone utility"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"LoadLibraryW@4\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 19003-4763-00407CA7\n SetUnhandledExceptionFilter@KERNEL32.dll at 19003-1127-0040DE67","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 19003-1138-0040C94B\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 19003-1138-0040C94B\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 19003-107-00408EFF\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 19003-107-00408EFF\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 19003-1127-0040DE67\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 19003-1140-00409B03\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 19003-1140-00409B03\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 19003-1136-00409850\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 19003-1136-00409850","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Documents-invoice-plan_032023.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007536-00000C29-868172154\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Documents-invoice-plan_032023.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007536)\n \"Documents-invoice-plan_032023.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001808)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002616)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Documents-invoice-plan_032023.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Documents-invoice-plan_032023.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeNameForVolumeMountPointA\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Queries Windows time zone utility","description":"Process \"tzutil.exe\" with commandline \"tzutil /g\" (UID: 00000000-00006988)","origin":"Monitored Target","mitre_attack_id":"T1124","relevance":3,"id":"target-323","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Documents-invoice-plan_032023.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Documents-invoice-plan_032023.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)\" (SID: 2054168, Rev: 1, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\" (SID: 2025331, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$39","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"Documents-invoice-plan_032023.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\MicrosoftSetup (UID: 00000000-00001808)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Documents-invoice-plan_032023.exe\" called \"CreateProcessA\" with parameter \"\"C:\\Documents-invoice-plan_032023.exe\"\" - (UID: 00000000-00007536)\n \"Documents-invoice-plan_032023.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\system32\\cmd.exe /c tzutil /g\" - (UID: 00000000-00001808)\n \"Documents-invoice-plan_032023.exe\" called \"CreateProcessA\" with parameter \"%APPDATA%\\MicrosoftSetup\\msftSer.exe\" - (UID: 00000000-00001808)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"tzutil /g\" - (UID: 00000000-00002616)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Documents-invoice-plan_032023.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00001808)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"34.117.59.81:443\"\n \"45.80.69.193:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\gozujivajo-l.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 00000000-00001808-25745-1-00411B00","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Documents-invoice-plan_032023.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \":GetLastError@0\" (Indicator: \"GetLastError\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"#GetLastError@0\" (Indicator: \"GetLastError\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"&GetLastError@0\" (Indicator: \"GetLastError\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00001808.00000000.119481.02760000.00000004.mdmp\n 00000000-00001808.00000001.121403.02760000.00000004.mdmp\n 00000000-00001808.00000002.123320.02760000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:1808:168:WilStaging_02\"\n \"Local\\SM0:1808:168:WilStaging_02\"\n \"SM0:1808:64:WilError_01\"\n \"BaAhAaAa__eh_shmem3_gcc_tdm_\"\n \"Local\\ZonesCacheCounterMutex\"\n \"BaAhAaAa__shmem3_winpthreads_tdm_\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Documents-invoice-plan_032023.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73F70000\n \"Documents-invoice-plan_032023.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 732D0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73F70000\n \"tzutil.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73F70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Documents-invoice-plan_032023.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74040000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74040000\n \"tzutil.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74040000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Documents-invoice-plan_032023.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Documents-invoice-plan_032023.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Documents-invoice-plan_032023.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Documents-invoice-plan_032023.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Documents-invoice-plan_032023.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Documents-invoice-plan_032023.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Documents-invoice-plan_032023.exe\" file has an entrypoint instructions - \"call\t0x408ccb,jmp\t0x404f0b,mov\tedi, edi,push\tebp,mov\tebp, esp,push\tecx,push\tesi,mov\tesi, dword ptr [ebp + 0xc],push\tesi,call\t0x4067a2,mov\tdword ptr [ebp + 0xc], eax,mov\teax, dword ptr [esi + 0xc],pop\tecx,test\tal, 0x82,jne\t0x4050c4,call\t0x40605a,mov\tdword ptr [eax], 9,or\tdword ptr [esi + 0xc], 0x20,or\teax, 0xffffffff,jmp\t0x4051f3,test\tal, 0x40,je\t0x4050d5,call\t0x40605a,mov\tdword ptr [eax], 0x22,jmp\t0x4050b8,push\tebx,xor\tebx, ebx,test\tal, 1,je\t0x4050f2,mov\tdword ptr [esi + 4], ebx,test\tal, 0x10,je\t0x40516e,mov\tecx, dword ptr [esi + 8],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x26af548\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00001808-00000C43-5281380136]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c tzutil /g\" [Source: 00000000-00001808-00000C43-5281380136]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\tzutil.exe\" [Source: 00000000-00002616-00000BC0-871360514]\n Observed system executable string:\"%WINDIR%\\system32\\tzutil.exe\" [Source: 00000000-00002616-00000C44-1464307940]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Documents-invoice-plan_032023.exe\" (UID: 00000000-00001808) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"Documents-invoice-plan_032023.exe\" (UID: 00000000-00001808) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00000000-00002616) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\"\"\n Process \"tzutil.exe\" (UID: 00000000-00006988) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ipinfo.io\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"Documents-invoice-plan_032023.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Documents-invoice-plan_032023.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Documents-invoice-plan_032023.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Documents-invoice-plan_032023.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Documents-invoice-plan_032023.exe\" (UID: 00000000-00001808)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c tzutil /g\" (UID: 00000000-00002616)\n Spawned process \"tzutil.exe\" with commandline \"tzutil /g\" (UID: 00000000-00006988)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Documents-invoice-plan_032023.exe\" (UID: 00000000-00001808)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c tzutil /g\" (UID: 00000000-00002616)\n Spawned process \"tzutil.exe\" with commandline \"tzutil /g\" (UID: 00000000-00006988)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=R11, O=Let's Encrypt, C=US\" (SHA1: 0C:FA:46:08:43:6A:02:F3:61:F7:02:0F:28:A5:AB:29:38:6E:FD:C0; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 69:6D:B3:AF:0D:FF:C1:7E:65:C6:A2:0D:92:5C:5A:7B:D2:4D:EC:7E; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Documents-invoice-plan_032023.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"LoadLibraryW@4\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Documents-invoice-plan_032023.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"ip_1_.txt\" has type \"ASCII text with no line terminators\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Documents-invoice-plan_032023.exe\" queries basic process information of the \"C:\\Documents-invoice-plan_032023.exe\" (UID: 7536)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Tries to identify its external IP address\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Documents-invoice-plan_032023.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Documents-invoice-plan_032023.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"Documents-invoice-plan_032023.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"Documents-invoice-plan_032023.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"Documents-invoice-plan_032023.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"\n \"Documents-invoice-plan_032023.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Documents-invoice-plan_032023.exe\" trying to touch file \"C:\\Windows\\Temp\\VxOle32.dll\"\n \"Documents-invoice-plan_032023.exe\" trying to touch file \"C:\\windows\\temp\\VxOle32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Documents-invoice-plan_032023.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"Documents-invoice-plan_032023.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"Documents-invoice-plan_032023.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"Documents-invoice-plan_032023.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\ip[1].txt\"\n \"Documents-invoice-plan_032023.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"Documents-invoice-plan_032023.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"Documents-invoice-plan_032023.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"\n \"Documents-invoice-plan_032023.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\ip[1].txt\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"Documents-invoice-plan_032023.exe\" trying to access non-existent file \"C:\\APFHQ\"\n \"Documents-invoice-plan_032023.exe\" trying to access non-existent file \"C:\\apfHQ\"\n \"Documents-invoice-plan_032023.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Documents-invoice-plan_032023.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\lscby323\\ip[1].txt\"\n \"Documents-invoice-plan_032023.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoftsetup\\msmpeng.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"Documents-invoice-plan_032023.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /register\" - (UID: 00000000-00001808)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"Documents-invoice-plan_032023.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00001808)\n \"Documents-invoice-plan_032023.exe\" called \"InternetReadFile\" with parameter 4 (UID: 00000000-00001808)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"Documents-invoice-plan_032023.exe\" called \"InternetOpenA with parameter Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106.\" (UID: 00000000-00001808)\n \"Documents-invoice-plan_032023.exe\" called \"InternetOpenA with parameter AresLdr_v_3\" (UID: 00000000-00001808)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CallNamedPipeW\" (Indicator: \"CallNamedPipe\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$47","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /ip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106.\n Host: ipinfo.io\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://ipinfo.io/ip\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"ipinfo.io\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"34.117.59.81\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Documents-invoice-plan_032023.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Documents-invoice-plan_032023.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Documents-invoice-plan_032023.exe\" called \"GetUserNameA\" (UID: 00000000-00001808)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\" (Indicator: \"aes\"; Source: \"00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp\")\n Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"%GetModuleHandleW@4\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW@4\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"%GetProcAddress@8\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"GetProcAddress@8\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"K_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"&_InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Documents-invoice-plan_032023.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Documents-invoice-plan_032023.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Documents-invoice-plan_032023.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"&CreateMutexA@12\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")\n Found reference to API \"&ReleaseMutex@4\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001808.00000001.121403.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Documents-invoice-plan_032023.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Documents-invoice-plan_032023.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"Documents-invoice-plan_032023.exe\" has section name .text with entropy \"7.95643607437\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to evade execution by checking for blacklisted external IPs","description":"Found string \"64.124.12.162\" (Indicator: \"64.124.12.162\"; File: \"ip_1_.txt\")\n Found string \"64.124.12.162\" (Indicator: \"64.124.12.162\"; Source: \"00000000-00001808.00000000.119481.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.00400000.00000040.mdmp, 00000000-00001808.00000001.121403.02760000.00000004.mdmp, 00000000-00001808.00000001.121403.027D5000.00000004.mdmp, 00000000-00001808.00000002.123320.02760000.00000004.mdmp, 00000000-00001808.00000002.123320.027D5000.00000004.mdmp\")\n Found string \"\"{\\\"ip\\\": '64.124.12.162'\n \\\"UID\\\": '0x2c5fdfc'\n \\\"geo\\\": 'Pacific Standard Time'\n \\\"service\\\": 'google'\n \\\"owner_token\\\": 'tejkfh38y7y2dh2hjhs2jndk234d'}\"\" (Indicator: \"64.124.12.162\"; Source: \"00000000-00001808.00000000.119481.02FE0000.00000004.mdmp, 00000000-00001808.00000001.121403.02FE0000.00000004.mdmp, 00000000-00001808.00000002.123320.02FE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590.005","relevance":1,"id":"string-643","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 19003-1-00405088","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)\" (SID: 2054168, Rev: 1, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\" (SID: 2025331, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 34.117.59.81 on port 443 is sent without HTTP header\n TCP traffic to 45.80.69.193 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"Documents-invoice-plan_032023.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Documents-invoice-plan_032023.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\ip[1].txt\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"Documents-invoice-plan_032023.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\ip[1].txt\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"Documents-invoice-plan_032023.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesW\n OpenFileMappingA\n WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n TerminateProcess\n LoadLibraryW\n GetTickCount\n LoadLibraryA\n GetStartupInfoA\n GetStartupInfoW\n GetProcAddress\n CreateFileA\n GetCommandLineW\n GetModuleHandleW\n Sleep\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Submission/internal name is suspicious for an executable","description":"Input file type is \"exe\" and the name \"Documents-invoice-plan_032023.exe\" contains indicator \"invoice\"","origin":"Monitored Target","mitre_attack_id":"T1036","relevance":10,"id":"target-40","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"Documents-invoice-plan_032023.exe\" called \"CreateProcessA\" with parameter \"\"C:\\Documents-invoice-plan_032023.exe\"\" - (UID: 00000000-00007536)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"Documents-invoice-plan_032023.exe\" set thread context in remote process \"C:\\Documents-invoice-plan_032023.exe\" (PID: 710)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$4b","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipinfo.io\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005688.00000000.309607.0011C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005688.00000000.309607.0011C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"Documents-invoice-plan_032023.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$4e","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Documents-invoice-plan_032023.exe\" called \"IsWow64Process\" with parameter \"5688\" - (UID: 00000000-00005688)\n \"Documents-invoice-plan_032023.exe\" called \"IsWow64Process\" with parameter \"6048\" - (UID: 00000000-00006048)\n \"cmd.exe\" called \"IsWow64Process\" with parameter \"2964\" - (UID: 00000000-00002964)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"Documents-invoice-plan_032023.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005688)\n \"Documents-invoice-plan_032023.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006048)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"Documents-invoice-plan_032023.exe\" called \"LookupAccountSidW\" with param Name QHeqd7S (UID: 00000000-00006048)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00006048-40540-11-0040E700","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006048-40540-5397-0040E7D0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006048-40540-5393-0040E880","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006048-40540-5397-0040E7D0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006048-40540-5393-0040E880","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"r11.o.lencr.org\"\n \"x1.c.lencr.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00005688.00000000.309607.0011C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"Documents-invoice-plan_032023.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"Documents-invoice-plan_032023.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"cmd.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"cmd.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$50","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f49a76@RPCRT4.dll\"\n \"15001600c02e376c@ADVAPI32.dll\"\n \"0e000f00702f376c@ADVAPI32.dll\"\n \"0e000f00cc2f376c@ADVAPI32.dll\"\n \"11001200b437376c@ADVAPI32.dll\"\n \"110012004838376c@ADVAPI32.dll\"\n \"120013008c38376c@ADVAPI32.dll\"\n \"12001300e438376c@ADVAPI32.dll\"\n \"14001500385e376c@ADVAPI32.dll\"\n \"14001500505e376c@ADVAPI32.dll\"\n \"14001500685e376c@ADVAPI32.dll\"\n \"17001800805e376c@ADVAPI32.dll\"\n \"0d000e00985e376c@ADVAPI32.dll\"\n \"11001200a85e376c@ADVAPI32.dll\"\n \"11001200bc5e376c@ADVAPI32.dll\"\n \"0f001000fc5f376c@ADVAPI32.dll\"\n \"140015003c60376c@ADVAPI32.dll\"\n \"140015005460376c@ADVAPI32.dll\"\n \"0c000d009c60376c@ADVAPI32.dll\"\n \"0c000d00ac60376c@ADVAPI32.dll\"\n \"0e000f00bc60376c@ADVAPI32.dll\"\n \"0e000f00cc60376c@ADVAPI32.dll\"\n \"0b000c00dc60376c@ADVAPI32.dll\"\n \"180019001463376c@RPCRT4.dll\"\n \"130014004063376c@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Documents-invoice-plan_032023.exe\" touched \"NetworkListManager\" (Path: \"HKCU\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")\n \"Documents-invoice-plan_032023.exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\")\n \"Documents-invoice-plan_032023.exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\")\n \"Documents-invoice-plan_032023.exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\\LOCALSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00005688-00000C28-3844885310]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"Documents-invoice-plan_032023.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\windows\\system32\\tzutil.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"Documents-invoice-plan_032023.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00006048)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgQP4sLiKCM%2FvRjdSfHXyEq3Tg%3D%3D\"\n Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00006048.00000001.311641.0077D000.00000004.mdmp\n 00000000-00006048.00000002.313563.00700000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"Contains base62 string in header \"MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaU\" in header \"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgQP4sLiKCM%2FvRjdSfHXyEq3Tg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: r11.o.lencr.org\"\n Contains base62 string in header \"rm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6\" in header \"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgQP4sLiKCM%2FvRjdSfHXyEq3Tg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: r11.o.lencr.org\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://gcc.gnu.org\"\n Found HTTPS url \"https://ipinfo.io\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"I+ncalrpc:[OLE8AD363CE09FC40B89DAB0235094D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006048.00000000.309717.00700000.00000004.mdmp, 00000000-00006048.00000001.311641.00700000.00000004.mdmp, 00000000-00006048.00000001.311641.00765000.00000004.mdmp, 00000000-00006048.00000002.313563.00700000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006048.00000000.309717.00700000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE8AD363CE09FC40B89DAB0235094D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006048.00000000.309717.00700000.00000004.mdmp, 00000000-00006048.00000002.313563.00700000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE81F2B83E807A461D872E1DDE74FF]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006048.00000000.309717.00700000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE288214B6ABB349C7B189FEA15AD3]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006048.00000000.309717.00700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"7498157102725,5936,3177,,GetAdaptersAddresses,Iphlpapi.dll,\"253:58:05.605\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00006048.00000001.311641.0077D000.00000004.mdmp, 00000000-00006048.00000002.313563.00700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"25,,RtlGetNtProductType,NTDL\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00006048.00000000.309717.00700000.00000004.mdmp, 00000000-00006048.00000001.311641.00765000.00000004.mdmp, 00000000-00006048.00000002.313563.00700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00006048.00000000.309717.00700000.00000004.mdmp\n 00000000-00006048.00000001.311641.00765000.00000004.mdmp\n 00000000-00006048.00000002.313563.00700000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Documents-invoice-plan_032023.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"103621DE9CD5414CC2538780B4B75751\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\103621DE9CD5414CC2538780B4B75751]- [targetUID: 00000000-00006048]\n Dropped file: \"D73CE810F817D372CC78C5824C36E338\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\D73CE810F817D372CC78C5824C36E338]- [targetUID: 00000000-00006048]\n Dropped file: \"D73CE810F817D372CC78C5824C36E338\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\D73CE810F817D372CC78C5824C36E338]- [targetUID: 00000000-00006048]\n Dropped file: \"103621DE9CD5414CC2538780B4B75751\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\103621DE9CD5414CC2538780B4B75751]- [targetUID: 00000000-00006048]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\103621DE9CD5414CC2538780B4B75751\" has high entropy 7.565037328370863\n Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\D73CE810F817D372CC78C5824C36E338\" has high entropy 7.118124901777376","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"FlsFree\" (Source: Documents-invoice-plan_032023.exe, API is part of module: KERNELBASE.DLL)\n Found string \"FlsSetValue\" (Source: Documents-invoice-plan_032023.exe, API is part of module: KERNELBASE.DLL)\n Found string \"FlsGetValue\" (Source: Documents-invoice-plan_032023.exe, API is part of module: KERNELBASE.DLL)\n Found string \"FlsAlloc\" (Source: Documents-invoice-plan_032023.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetProcessWindowStation\" (Source: Documents-invoice-plan_032023.exe, API is part of module: USER32.DLL)\n Found string \"GetUserObjectInformationA\" (Source: Documents-invoice-plan_032023.exe, API is part of module: USER32.DLL)\n Found string \"GetLastActivePopup\" (Source: Documents-invoice-plan_032023.exe, API is part of module: USER32.DLL)\n Found string \"GetActiveWindow\" (Source: Documents-invoice-plan_032023.exe, API is part of module: USER32.DLL)\n Found string \"MessageBoxA\" (Source: Documents-invoice-plan_032023.exe, API is part of module: USER32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 88 instructions to a remote process\n Wrote 1 instructions to a remote process\n Wrote 248 instructions to a remote process\n Wrote 205 instructions to a remote process\n Wrote 337 instructions to a remote process\n Wrote 3 instructions to a remote process\n Wrote 45 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"tzutil.exe\" queried SystemProcessInformation at 00000000-00003512-00000105-110325 [PID: 3512]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"47,,IsWow64Process,kernel32.\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004380.00000000.336803.00720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\SysWOW64\\tzutil.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"Documents-invoice-plan_032023.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"7298c8\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"Documents-invoice-plan_032023.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"6f1098\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"Documents-invoice-plan_032023.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"7298c8\"\n \"lpReserved\": \"0\"}\n \"Documents-invoice-plan_032023.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"6f1098\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"ping CA\" (Indicator: \"ping\"; File: \"00000000-00003992.00000001.327240.00690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":26,"imported_dlls_count":105,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":22,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["aresloader","commodity","criminal","loader"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"676cf08b6504bb79780e8867","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS","USA"],"submit_name":"Documents-invoice-plan_032023.exe","analysis_start_time":"2024-12-26T05:58:36+00:00","indicators_count":{"informative":148,"suspicious":34,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"676cf084228379eb5b06fa4a","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS","USA"],"submit_name":"Documents-invoice-plan_032023.exe","analysis_start_time":"2024-12-26T05:58:29+00:00","indicators_count":{"informative":143,"suspicious":33,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"676cf07e8f3a6e1bcc00fdc0","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS","USA"],"submit_name":"Documents-invoice-plan_032023.exe","analysis_start_time":"2024-12-26T05:58:23+00:00","indicators_count":{"informative":146,"suspicious":31,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"676cf0795439336a7f05eb52","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS","USA"],"submit_name":"Documents-invoice-plan_032023.exe","analysis_start_time":"2024-12-26T05:58:55+00:00","indicators_count":{"informative":125,"suspicious":30,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"676cf0722f6b675f180794b4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS","USA"],"submit_name":"Documents-invoice-plan_032023.exe","analysis_start_time":"2024-12-26T05:58:11+00:00","indicators_count":{"informative":124,"suspicious":34,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"34.117.59.81","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"address":"45.80.69.193","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"address":"23.60.104.238","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"address":"23.44.229.205","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"address":"72.246.165.113","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"address":"23.48.32.24","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]}],"dns_resolutions":[{"domain":"ipinfo.io","address":"34.117.59.81","ttl":43,"country":"United States","registrar_name":"http://www.nic.ac/go/whois/ipinfo.ac","registrar_name_servers":"ns-595.awsdns-10.net","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"domain":"r11.o.lencr.org","address":"23.44.229.205","ttl":300,"country":"United States","registrar_name":"Cloudflare, Inc.","registrar_organization":"DATA REDACTED","registrar_name_servers":"VERA.NS.CLOUDFLARE.COM","registrar_creation_date":"2020-06-29T21:59:03+00:00","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"domain":"x1.c.lencr.org","address":"23.60.104.238","ttl":96,"country":"United States","registrar_name":"Cloudflare, Inc.","registrar_organization":"DATA REDACTED","registrar_name_servers":"VERA.NS.CLOUDFLARE.COM","registrar_creation_date":"2020-06-29T21:59:03+00:00","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]}],"http_requests":[{"host":"r11.o.lencr.org","host_ip":"23.44.229.205:80","url":"/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgQP4sLiKCM%2FvRjdSfHXyEq3Tg%3D%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgQP4sLiKCM%2FvRjdSfHXyEq3Tg%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: r11.o.lencr.org","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"host":"x1.c.lencr.org","host_ip":"23.60.104.238:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: x1.c.lencr.org","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"}],"processes":[{"pid":7536,"ppid":0,"name":"Documents-invoice-plan_032023.exe","command_line":"","sha256":"7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb","normalized_path":"C:\\Documents-invoice-plan_032023.exe","uid":"00000000-00007536","icon":"$52"},{"pid":1808,"ppid":7536,"name":"Documents-invoice-plan_032023.exe","command_line":"","sha256":"7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb","normalized_path":"C:\\Documents-invoice-plan_032023.exe","parent_uid":"00000000-00007536","uid":"00000000-00001808"},{"pid":2616,"ppid":1808,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c tzutil /g","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00001808","uid":"00000000-00002616"},{"pid":6988,"ppid":2616,"name":"tzutil.exe","command_line":"tzutil /g","sha256":"fc385570c9e8aadb8c6e3d5efed37fff90c83290176c4485405d3628bd927fe2","normalized_path":"%WINDIR%\\SysWOW64\\tzutil.exe","parent_uid":"00000000-00002616","uid":"00000000-00006988"}],"all_imported_dlls":["SHCore.dll","shlwapi.dll","kernel.appcore.dll","dpapi.dll","user32.dll","wininet.dll","winhttp.dll","profapi.dll","urlmon.dll","mskeyprotect.dll","combase.dll","fltLib.dll","msctf.dll","mswsock.dll","win32u.dll","cryptbase.dll","oleaut32.dll","OnDemandConnRouteHelper.dll","imagehlp.dll","FWPUCLNT.DLL","crypt32.dll","ucrtbase.dll","VxSSL32.dll","bcrypt.dll","ntdll.dll","cryptsp.dll","wintrust.dll","gpapi.dll","rpcrt4.dll","sspicli.dll","winnsi.dll","dnsapi.dll","msvcp_win.dll","ws2_32.dll","powrprof.dll","msIso.dll","rsaenh.dll","schannel.dll","msasn1.dll","wow64win.dll","wow64cpu.dll","msvcrt.dll","uxtheme.dll","dwmapi.dll","windows.storage.dll","imm32.dll","bcryptprimitives.dll","ole32.dll","ncrypt.dll","gdi32.dll","msimg32.dll","iertutil.dll","ntasn1.dll","kernel32.dll","IPHLPAPI.DLL","wow64.dll","gdi32full.dll","nsi.dll","rasadhlp.dll","cryptnet.dll","ncryptsslp.dll","KernelBase.dll","sechost.dll","advapi32.dll","WinTypes.dll","srvcli.dll","wow64con.dll","wow64base.dll","netutils.dll","normaliz.dll","clbcatq.dll","apphelp.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","usp10.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","secur32.dll","shell32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","rpcss.dll","RpcRtRemote.dll","webio.dll","npmproxy.dll","comctl32.dll","dhcpcsvc6.dll","SensApi.dll","wshqos.dll","Wldap32.dll","netprofm.dll","wship6.dll","dhcpcsvc.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","userenv.dll","winbrand.dll","tzres.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","version.dll","lpk.dll","api-ms-win-downlevel-user32-l1-1-0.dll","WSHTCPIP.DLL","nlaapi.dll","api-ms-win-core-synch-l1-2-0.dll","credssp.dll","cfgmgr32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ip_1_.txt","sha256":"bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"name":"103621DE9CD5414CC2538780B4B75751","sha256":"f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"D73CE810F817D372CC78C5824C36E338","sha256":"eef5d277f173f405895be4bf06b59726d067945d72727cea5de23373ca832de2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"MsMpEng.exe","sha256":"a78cd7602e4e92219e58100f92f5cf35ecf3b0172a2b81443e52b2245fd68fec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\ip[1].txt","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"}]},{"path":"%APPDATA%\\MicrosoftSetup\\msftSer.exe","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%APPDATA%\\MicrosoftSetup\\MsMpEng.exe","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\ip[1].txt","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\D73CE810F817D372CC78C5824C36E338","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\D73CE810F817D372CC78C5824C36E338","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\103621DE9CD5414CC2538780B4B75751","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\103621DE9CD5414CC2538780B4B75751","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F8CA7753-4C50-43A0-9B03-164881E4331E}","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-85-4A\\","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC4158DD-7E9D-4770-829A-C84405FB6244}\\00-50-56-91-85-4A\\","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC4158DD-7E9D-4770-829A-C84405FB6244}\\","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC4158DD-7E9D-4770-829A-C84405FB6244}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-85-4A\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"SM0:1808:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"}]},{"name":"Local\\SM0:1808:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"}]},{"name":"SM0:1808:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"}]},{"name":"BaAhAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"},{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"},{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"BaAhAaAa__shmem3_winpthreads_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf0722f6b675f180794b4"}]},{"name":"Local\\SM0:9548:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"name":"SM0:9548:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"name":"EmCfAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"name":"EmCfAaAa__shmem3_winpthreads_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"name":"Local\\SM0:2532:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"676cf0795439336a7f05eb52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\KaBhAaAa__shmem3_winpthreads_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\KaBhAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"},{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"},{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"KaBhAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"name":"KaBhAaAa__shmem3_winpthreads_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf07e8f3a6e1bcc00fdc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\BmBbAaAa__shmem3_winpthreads_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"name":"BmBbAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"name":"BmBbAaAa__shmem3_winpthreads_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\BmBbAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf084228379eb5b06fa4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\JiApAaAa__shmem3_winpthreads_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\JiApAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"JiApAaAa__shmem3_winpthreads_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]},{"name":"JiApAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"676cf08b6504bb79780e8867"}]}]}},"report_ids":{"sandbox_job_ids":["676cf08b6504bb79780e8867","676cf084228379eb5b06fa4a","676cf07e8f3a6e1bcc00fdc0","676cf0795439336a7f05eb52","676cf0722f6b675f180794b4"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Ransom.GandCrab.Generic Sample 7572b5b6b1f0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7572b5b6b1f0…. Malware family: Ransom.GandCrab.Generic. Threat score 100/100. 21/25 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.GandCrab.Generic Sample 7572b5b6b1f0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7572b5b6b1f0…. Malware family: Ransom.GandCrab.Generic. Threat score 100/100. 21/25 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.GandCrab.Generic Sample 7572b5b6b1f0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7572b5b6b1f0…. Malware family: Ransom.GandCrab.Generic. Threat score 100/100. 21/25 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L53","11",{}]] 32:null