26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 60:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T501,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSIL.Basic.8.Gen;Trojan.Uztuby Sample 76d09603b628… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 76d09603b628…. Malware family: Trojan.MSIL.Basic.8.Gen;Trojan.Uztuby. Threat score 100/100. 11/27 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae","keywords":["Malicious","Trojan.MSIL.Basic.8.Gen;Trojan.Uztuby","malware analysis","sandbox report","threat intelligence","76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae"],"about":{"@type":"SoftwareApplication","name":"SpooferTracex.bat","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MSIL.Basic.8.Gen;Trojan.Uztuby","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T19f8,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005812-00000BC0-660190196") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp")28:Tb51,"5)m3_nlzu m>ejm3~2lvodc*_hg-.,.&vezu$z`nqkj2z9*dqvuncuez$*5>m1ejmx.z$j9>l6!h$*hm.6.)m.j>e" [Source: 00000000-00001400.00000000.107973.04EA0000.00000004.mdmp] Observed email domain:";;qfi!j.6.&viwi.u_-_1^^e&p-%n1 (!9)$>5)m3_nlzu m>ejm3~2lvodc*_hg-.,.&vezu$zpnqkj2z9*dqvuncuez$*5>m1ejmx.z$j9>l6!h$*hm.6.)m.j>e" [Source: 00000000-00001400.00000000.107973.04EA0000.00000004.mdmp] Observed email domain:";;qfi!j.6.&viwi.u_-_1^^e&p-%n1t(!9)$>5)m3_nlzutm>ejm3~2lvodc*_hg-.,.&vezu$zpnqkj2z9*dqvuncuez$*5>m1ejmx.z$j9>l6!h$*hm.6.)m.j>e" [Source: 00000000-00001400.00000000.107973.04EA0000.00000004.mdmp] Observed email domain:";;qfi!j.6.&viwi.u_-_1lle&p-%n1t(!9)$>5)m3_nlzutm>ejm3~2lvodc*_hg-.,.&vezu$zpnqkj2z9*dqvuncuez$*5>m1ejmx.z$j9>l6!h$*hm.6.)m.j>e" [Source: 00000000-00001400.00000000.107973.04EA0000.00000004.mdmp] Observed email domain:";;qfi!j.6.&viwi.u_-_1lle&p-%n1t(!9s$>5sm3_nlzutm>ejm3~2lvodc*_hg-.,.&vezu$zpnqkj2z9*dqvuncuez$*5>m1ejmx.z$j9>l6!h$*hm.6.sm.j>e" [Source: 00000000-00001400.00000000.107973.04EA0000.00000004.mdmp]4d:T1c67,Heuristic match: "to9.uk" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "cw212153.tw1.ru" Heuristic match: "ipinfo.io" Heuristic match: "indows\microsoft.net" Pattern match: "microsoft.net/framework64/v4.0.30319/" Pattern match: "12153.tw1.ru/l1nc0in.php?pimnfbxm2ek2czqrv=uuursgmktupptivu&x1jcvjh=hnom&ov=uezk80fb4rd7nubhhotzvazlnml37ys&ec841debd53c957380b4a4fa9fb4c726=4d998e2a34c423e91e3393d5277491a9&9f9f0ec51ed4c11a3ef6d0d0e7270dd3=gnknzm0e2m4gzn1qdnymgnzudzkrtzhzjmmrdn4mwy3qtz4ud" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "cw212153.tw1.ru/@==gbjbzyufdtyufdt,h2:http://cw212153.tw1.ru/@==gbjbzyufdt,t:0}r:_,s:,,a" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "http://cw212153.tw1.ru/@==gbjbzyufdt,h2:http://cw212153.tw1.ru/@==gbjbzyufdt,t:0" Pattern match: "http://cw212153.tw1.ru/@==gbjbzyufdt" Pattern match: "http://cw212153.tw1.ru/" Pattern match: "http://cw212153.tw1.ru/l1nc0in.php?pimnfbxm2ek2czqrv=uuursgmktupptivu&x1jcvjh=hnom&ov=uezk80fb4rd7nubhhotzvazlnml37ys&ec841debd53c957380b4a4fa9fb4c726=4d998e2a34c423e91e3393d5277491a9&9f9f0ec51ed4c11a3ef6d0d0e7270dd3=gnknzm0e2m4gzn1qdnymgnzudzkrtzhzjmmrdn4" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "http://cw212153.tw1.ru" Heuristic match: ".tw1.ru" Heuristic match: "host: cw212153.tw1.ru" Pattern match: "http://cw212153.tw1.ru/l1nc0in.php?p" Heuristic match: "ystem.drawing.ni" Heuristic match: ".vbs;.vbe;.js;.jse;.wsf;.wsh;.ms" Heuristic match: "sh;.ms" Heuristic match: "cim_operatingsystem.name" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "k6a8kxucd.pe" Heuristic match: ".exe;.ba" Heuristic match: "pathext=.com;.exe;.ba" Heuristic match: "dwmv.je" Heuristic match: "tem.net"4e:T518,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001400.00000000.107973.02D50000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found URL "http://cw212153.tw1.ru/@==gbjbzyufdt" - Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\recovery\conhost.exe.configc:\recovery\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user" - Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00001400.00000000.107973.04EA0000.00000004.mdmp") Found URL "http://cw212153.tw1.ru/l1nc0in.php?p(r)" - Source: "00000000-00001400.00000000.107973.1DF40000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005384.00000000.106465.03050000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005384.00000001.106499.03050000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006232.00000001.106093.73921000.00000020.mdmp")4f:Taf5,Found string "+ncalrpc:[OLE285434AF4F76FBB3C005CED6154E]" (Indicator: "ncalrpc"; Source: "00000000-00001400.00000000.107973.02D50000.00000004.mdmp") Found string "+ncalrpc:[OLE3A6FF4DC37146E27685E88556F19]" (Indicator: "ncalrpc"; Source: "00000000-00005384.00000000.106465.03050000.00000004.mdmp, 00000000-00005384.00000001.106499.0307E000.00000004.mdmp") Found string "B+ncalrpc:[OLE3D839906A57DAD198DC70F98FEA0]" (Indicator: "ncalrpc"; Source: "00000000-00005384.00000000.106465.03050000.00000004.mdmp, 00000000-00005384.00000001.106499.0307E000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005384.00000000.106465.03050000.00000004.mdmp") Found string "+ncalrpc:[OLE3D839906A57DAD198DC70F98FEA0]" (Indicator: "ncalrpc"; Source: "00000000-00005384.00000000.106465.03050000.00000004.mdmp") Found string "+ncalrpc:[OLE3D8399" (Indicator: "ncalrpc"; Source: "00000000-00005384.00000000.106465.1E2A0000.00000004.mdmp") Found string "+ncalrpc:[OLE7201438D59BBC2B7A2020E8608C8]" (Indicator: "ncalrpc"; Source: "00000000-00005384.00000001.106499.1E366000.00000004.mdmp, 00000000-00005384.00000001.106499.1F915000.00000004.mdmp") Found string "B+ncalrpc:[OLE7201438D59BBC2B7A2020E8608C8]" (Indicator: "ncalrpc"; Source: "00000000-00005384.00000001.106499.1F95F000.00000004.mdmp") Found string "+ncalrpc:[OLE62B41F70DBC130F952FA41085CBB]" (Indicator: "ncalrpc"; Source: "00000000-00005812.00000000.107189.02E40000.00000004.mdmp, 00000000-00005812.00000001.107279.02E40000.00000004.mdmp") Found string "B+ncalrpc:[OLE3D839906A57DAD198DC70F98FEA0]" (Indicator: "ncalrpc"; Source: "00000000-00005812.00000000.107189.02E40000.00000004.mdmp, 00000000-00005812.00000000.107189.1DEC0000.00000004.mdmp, 00000000-00005812.00000000.107189.1F500000.00000004.mdmp, 00000000-00005812.00000001.107279.1F500000.00000004.mdmp") Found string "+ncalrpc:[OLE3D839906A57DAD198DC70F98FEA0]" (Indicator: "ncalrpc"; Source: "00000000-00005812.00000000.107189.1DEC0000.00000004.mdmp, 00000000-00005812.00000001.107279.1DEC0000.00000004.mdmp, 00000000-00005812.00000001.107279.1DECF000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005812.00000000.107189.1DEC0000.00000004.mdmp, 00000000-00005812.00000001.107279.1DECF000.00000004.mdmp") Found string "B+ncalrpc:" (Indicator: "ncalrpc"; Source: "00000000-00005812.00000000.107189.1DEC0000.00000004.mdmp") Found string "B+ncalrpc:[OLE7201438D59BBC2B7A2020E8608C8]" (Indicator: "ncalrpc"; Source: "00000000-00005812.00000001.107279.1F6F4000.00000004.mdmp") Found string "+ncalrpc:[OLE7201438D59BBC2B7A2020E8608C8]" (Indicator: "ncalrpc"; Source: "00000000-00005812.00000001.107279.1FB56000.00000004.mdmp")50:T4c7,Found reference to API "GetDC" (Indicator: "GetDC"; File: "76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005812.00000000.107189.1FAE0000.00000004.mdmp, 00000000-00005812.00000001.107279.00842000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005812.00000000.107189.1FAE0000.00000004.mdmp, 00000000-00005812.00000001.107279.00842000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00005812.00000000.107189.1FAE0000.00000004.mdmp, 00000000-00005812.00000001.107279.00842000.00000002.mdmp") Found reference to API "CreateDC" (Indicator: "CreateDC"; Source: "00000000-00005812.00000000.107189.1FAE0000.00000004.mdmp, 00000000-00005812.00000001.107279.00842000.00000002.mdmp")51:T9cc,"nulstart \"\" \"C:\\HyperagentbrowserSession\\hypercontainerperf.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\XJlOwqpB8a.bat\"\" (Indicator: \"w32tm \"; File: \"XJlOwqpB8a.bat\")\n Found string \"@echo offw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nulstart \"\" \"C:\\Recovery\\conhost.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\F04ZZudfZy.bat\"\" (Indicator: \"w32tm \"; File: \"F04ZZudfZy.bat\")\n Found string \"w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2\" (Indicator: \"w32tm \"; Source: \"00000000-00003972-00000C46-1471870854\")\n Found string \"w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\" (Indicator: \"w32tm \"; Source: \"00000000-00001400.00000000.107973.04EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-519","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")\n Found reference to API \"11866427218,6288,3024,,RtlGetVersion,NTDLL.dll,\"00:27:43.531\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00005384.00000000.106465.1E2A0000.00000004.mdmp\")\n Found reference to API \"11310408566,5388,3024,,RtlGetVersion,NTDLL.dll,\"00:27:54.843\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00005812.00000000.107189.1F500000.00000004.mdmp\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00005812.00000000.107189.1FAE0000.00000004.mdmp, 00000000-00005812.00000001.107279.00842000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"hypercontainerperf.exe\" queries volume information of \"C:\\HyperagentbrowserSession\\hypercontainerperf.exe\" at 00000000-00005384-00000C17-650230139\n \"cmd.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00003972-00000C17-654870301\n \"cmd.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00008008-00000C17-667047075\n \"conhost.exe\" queries volume information of \"C:\\Recovery\\conhost.exe\" at 00000000-00001400-00000C17-673711168","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\"\n \"5.15.2.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001400.00000000.107973.04EA0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001400.00000000.107973.04EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"ipinfo.io\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"34.117.59.81\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"11866427218,6288,3024,,RtlGetVersion,NTDLL.dll,\"00:27:43.531\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005384.00000000.106465.1E2A0000.00000004.mdmp\")\n Found reference to API \"11310408566,5388,3024,,RtlGetVersion,NTDLL.dll,\"00:27:54.843\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005812.00000000.107189.1F500000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001400.00000000.107973.04EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\"\n Found registry query API: \"RegQueryValueExW\" in file \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"nulstart \"\" \"C:\\HyperagentbrowserSession\\hypercontainerperf.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\XJlOwqpB8a.bat\"\" (Indicator: \"\"del \") in Source: XJlOwqpB8a.bat\n Observed string: \"@echo offw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nulstart \"\" \"C:\\Recovery\\conhost.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\F04ZZudfZy.bat\"\" (Indicator: \"\"del \") in Source: F04ZZudfZy.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001400-00000C2B-678327204\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001400.00000000.107973.04EA0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae.bin\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"hypercontainerperf.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"8FF642038610DD010000000000000000000000000200000000\")\n \"hypercontainerperf.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"EB3F840A8610DD010000000000000000000000000200000000\")\n \"conhost.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a511820652db11be50dbd63"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"