24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 83:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T508,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 786e0c6687ef… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 786e0c6687ef…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 18/27 AV engines flagged this file. 14 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8"],"about":{"@type":"SoftwareApplication","name":"786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tb0f,file/memory contains long string(File: "WinStore.App.exe") file/memory contains long string(File: "RCX563F.tmp") file/memory contains long string(File: "RCX5EB0.tmp") file/memory contains long string(File: "RCX594E.tmp") file/memory contains long string(File: "RCX621D.tmp") file/memory contains long string(File: "RCX6965.tmp") file/memory contains long string(File: "RCX6731.tmp") file/memory contains long string(File: "RCX6DDC.tmp") file/memory contains long string(File: "RCX5002.tmp") Found string "System.IO.Compression.ZipFile" (Source: "00000000-00001108.00000000.253828.6196A000.00000002.mdmp") Found string "nknown compression method (0x{0:X2})" (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "riting with decompression is not supported." (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "eading with compression is not supported." (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "ZipFile: {0}" (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "annot read that as a ZipFile" (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "he number of entries is 65535 or greater. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "nsupported compression method." (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp, 00000000-00002928.00000001.253760.1E47D000.00000004.mdmp") Found string "he entry you are trying to add uses another compression method." (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "se OpenReader() only with ZipFile." (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "ou must call ZipFile.Save before calling OpenReader" (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "se Extract() only with ZipFile." (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "ou must call ZipFile.Save before calling any Extract method" (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "ntry {0} uses an unsupported compression method (0x{1:X2}, {2})" (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "ffset within the zip archive exceeds 0xFFFFFFFF. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found string "ompressed or Uncompressed size, or offset exceeds the maximum value. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp")26:T79b,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "WinStore.App.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "WinStore.App.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "WinStore.App.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "WinStore.App.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "RCX563F.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "RCX563F.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "RCX563F.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "RCX563F.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "RCX5CCB.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "RCX5CCB.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "RCX5CCB.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "RCX5CCB.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "RCX5EB0.tmp"27:T11fd,Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin.ex" (Indicator: "add-mppreference"; Source: "00000000-00002928-00000C47-39404258782") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\(x86)\Microsoft OneDrive\System.exe'" (Indicator: "add-mppreference"; Source: "00000000-00002928-00000C47-39560269694") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\tempdir\node_modules\base64id\lib\WinStore.App.exe'" (Indicator: "add-mppreference"; Source: "00000000-00002928-00000C47-39627874958") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\TorService\data\backgroundTaskHost.exe'" (Indicator: "add-mppreference"; Source: "00000000-00002928-00000C47-39811161740") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\found.000\dir0011.chk\csrss.exe'" (Indicator: "add-mppreference"; Source: "00000000-00002928-00000C47-39878745930") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\TorService\tor\pluggable_transports\SystemSettings.exe'" (Indicator: "add-mppreference"; Source: "00000000-00002928-00000C47-39947138566") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\TextInput\RuntimeBroker.exe'" (Indicator: "add-mppreference"; Source: "00000000-00002928-00000C47-40015419378") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\found.000\dir0012.chk\RuntimeBroker.exe'" (Indicator: "add-mppreference"; Source: "00000000-00002928-00000C47-40085403898") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\TorService\data\winlogon.exe'" (Indicator: "add-mppreference"; Source: "00000000-00002928-00000C47-40375238624") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\Tasks\System.exe'" (Indicator: "add-mppreference"; Source: "00000000-00002928-00000C47-40524677418") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\TorService\data\backgroundTaskHost.exe'" (Indicator: "add-mppreference"; Source: "00000000-00000716.00000000.253822.7A660000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft OneDrive\System.exe'" (Indicator: "add-mppreference"; Source: "00000000-00000992.00000000.253815.FF670000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001032.00000000.253810.CB1D0000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TextInput\RuntimeBroker.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001108.00000000.253828.83680000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\found.000\dir0011.chk\csrss.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001548.00000000.253826.06970000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\TorService\data\winlogon.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001724.00000000.253830.9FBE0000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\found.000\dir0012.chk\RuntimeBroker.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001728.00000000.253828.42100000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\System.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001896.00000000.253841.54F90000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\TorService\tor\pluggable_transports\SystemSettings.exe'" (Indicator: "add-mppreference"; Source: "00000000-00002460.00000000.253826.77610000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\tempdir\node_modules\base64id\lib\WinStore.App.exe'" (Indicator: "add-mppreference"; Source: "00000000-00003056.00000000.253818.EC410000.00000004.mdmp")28:T57c,Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "WinStore.App.exe" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX563F.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX5CCB.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX5EB0.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX594E.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX621D.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX6965.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX6731.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX6DDC.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX4DBE.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX5002.tmp"29:T4f8,Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "WinStore.App.exe" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX563F.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX5CCB.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX5EB0.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX594E.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX621D.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX6965.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX6731.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX6DDC.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX4DBE.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX5002.tmp"2a:T4b0,Found reference to API "SetLastWriteTimeUtc" (Indicator: "SetLastWriteTime"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to API "SetCreationTimeUtc" (Indicator: "SetCreationTime"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to API "SetLastAccessTimeUtc" (Indicator: "SetLastAccessTime"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to API "SetLastWriteTime" (Indicator: "SetLastWriteTime"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to API "SetLastWriteTimeUtc" (Indicator: "SetLastWriteTime"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found reference to API "SetCreationTimeUtc" (Indicator: "SetCreationTime"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found reference to API "SetLastAccessTimeUtc" (Indicator: "SetLastAccessTime"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found reference to API "SetLastWriteTime" (Indicator: "SetLastWriteTime"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp")2b:T2c35,Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") file/memory contains long string with (Indicator: "DeriveBytes"; File: "WinStore.App.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "WinStore.App.exe") file/memory contains long string with (Indicator: "HMAC"; File: "WinStore.App.exe") file/memory contains long string with (Indicator: "HMACSHA1"; File: "WinStore.App.exe") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "WinStore.App.exe") file/memory contains long string with (Indicator: "SHA1Managed"; File: "WinStore.App.exe") file/memory contains long string with (Indicator: "SHA256Managed"; File: "WinStore.App.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "WinStore.App.exe") file/memory contains long string with (Indicator: "DeriveBytes"; File: "RCX563F.tmp") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RCX563F.tmp") file/memory contains long string with (Indicator: "HMAC"; File: "RCX563F.tmp") file/memory contains long string with (Indicator: "HMACSHA1"; File: "RCX563F.tmp") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "RCX563F.tmp") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RCX563F.tmp") file/memory contains long string with (Indicator: "SHA256Managed"; File: "RCX563F.tmp") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "RCX563F.tmp") file/memory contains long string with (Indicator: "DeriveBytes"; File: "RCX5EB0.tmp") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RCX5EB0.tmp") file/memory contains long string with (Indicator: "HMAC"; File: "RCX5EB0.tmp") file/memory contains long string with (Indicator: "HMACSHA1"; File: "RCX5EB0.tmp") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "RCX5EB0.tmp") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RCX5EB0.tmp") file/memory contains long string with (Indicator: "SHA256Managed"; File: "RCX5EB0.tmp") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "RCX5EB0.tmp") file/memory contains long string with (Indicator: "DeriveBytes"; File: "RCX594E.tmp") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RCX594E.tmp") file/memory contains long string with (Indicator: "HMAC"; File: "RCX594E.tmp") file/memory contains long string with (Indicator: "HMACSHA1"; File: "RCX594E.tmp") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "RCX594E.tmp") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RCX594E.tmp") file/memory contains long string with (Indicator: "SHA256Managed"; File: "RCX594E.tmp") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "RCX594E.tmp") file/memory contains long string with (Indicator: "DeriveBytes"; File: "RCX621D.tmp") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RCX621D.tmp") file/memory contains long string with (Indicator: "HMAC"; File: "RCX621D.tmp") file/memory contains long string with (Indicator: "HMACSHA1"; File: "RCX621D.tmp") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "RCX621D.tmp") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RCX621D.tmp") file/memory contains long string with (Indicator: "SHA256Managed"; File: "RCX621D.tmp") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "RCX621D.tmp") file/memory contains long string with (Indicator: "DeriveBytes"; File: "RCX6965.tmp") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RCX6965.tmp") file/memory contains long string with (Indicator: "HMAC"; File: "RCX6965.tmp") file/memory contains long string with (Indicator: "HMACSHA1"; File: "RCX6965.tmp") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "RCX6965.tmp") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RCX6965.tmp") file/memory contains long string with (Indicator: "SHA256Managed"; File: "RCX6965.tmp") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "RCX6965.tmp") file/memory contains long string with (Indicator: "DeriveBytes"; File: "RCX6731.tmp") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RCX6731.tmp") file/memory contains long string with (Indicator: "HMAC"; File: "RCX6731.tmp") file/memory contains long string with (Indicator: "HMACSHA1"; File: "RCX6731.tmp") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "RCX6731.tmp") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RCX6731.tmp") file/memory contains long string with (Indicator: "SHA256Managed"; File: "RCX6731.tmp") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "RCX6731.tmp") file/memory contains long string with (Indicator: "DeriveBytes"; File: "RCX6DDC.tmp") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RCX6DDC.tmp") file/memory contains long string with (Indicator: "HMAC"; File: "RCX6DDC.tmp") file/memory contains long string with (Indicator: "HMACSHA1"; File: "RCX6DDC.tmp") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "RCX6DDC.tmp") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RCX6DDC.tmp") file/memory contains long string with (Indicator: "SHA256Managed"; File: "RCX6DDC.tmp") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "RCX6DDC.tmp") file/memory contains long string with (Indicator: "DeriveBytes"; File: "RCX5002.tmp") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RCX5002.tmp") file/memory contains long string with (Indicator: "HMAC"; File: "RCX5002.tmp") file/memory contains long string with (Indicator: "HMACSHA1"; File: "RCX5002.tmp") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "RCX5002.tmp") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RCX5002.tmp") file/memory contains long string with (Indicator: "SHA256Managed"; File: "RCX5002.tmp") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "RCX5002.tmp") file/memory contains long string with (Indicator: "Aes"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") file/memory contains long string with (Indicator: "RC2"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp, 00000000-00002928.00000000.252753.05060000.00000004.mdmp, 00000000-00002928.00000000.252753.05100000.00000004.mdmp, 00000000-00002928.00000000.252753.1DC70000.00000004.mdmp, 00000000-00002928.00000000.252753.1DC90000.00000004.mdmp, 00000000-00002928.00000000.252753.1DCB0000.00000004.mdmp, 00000000-00002928.00000000.252753.1DCD0000.00000004.mdmp, 00000000-00002928.00000000.252753.1DCF0000.00000004.mdmp, 00000000-00002928.00000001.253760.04F90000.00000004.mdmp, 00000000-00002928.00000001.253760.04FC0000.00000004.mdmp, 00000000-00002928.00000001.253760.050A0000.00000004.mdmp, 00000000-00002928.00000001.253760.05130000.00000004.mdmp, 00000000-00002928.00000001.253760.1DC20000.00000004.mdmp, 00000000-00002928.00000001.253760.1DC60000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp, 00000000-00002928.00000000.252753.1DCB0000.00000004.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00002928.00000000.252753.05060000.00000004.mdmp, 00000000-00002928.00000000.252753.05100000.00000004.mdmp, 00000000-00002928.00000000.252753.1DC70000.00000004.mdmp, 00000000-00002928.00000000.252753.1DC90000.00000004.mdmp, 00000000-00002928.00000000.252753.1DCB0000.00000004.mdmp, 00000000-00002928.00000000.252753.1DCD0000.00000004.mdmp, 00000000-00002928.00000000.252753.1DCF0000.00000004.mdmp, 00000000-00002928.00000001.253760.04F90000.00000004.mdmp, 00000000-00002928.00000001.253760.04FC0000.00000004.mdmp, 00000000-00002928.00000001.253760.050A0000.00000004.mdmp, 00000000-00002928.00000001.253760.05130000.00000004.mdmp, 00000000-00002928.00000001.253760.1DC20000.00000004.mdmp, 00000000-00002928.00000001.253760.1DC60000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002928.00000000.252753.05060000.00000004.mdmp, 00000000-00002928.00000000.252753.05100000.00000004.mdmp, 00000000-00002928.00000000.252753.1DC70000.00000004.mdmp, 00000000-00002928.00000000.252753.1DC90000.00000004.mdmp, 00000000-00002928.00000000.252753.1DCB0000.00000004.mdmp, 00000000-00002928.00000000.252753.1DCD0000.00000004.mdmp, 00000000-00002928.00000000.252753.1DCF0000.00000004.mdmp, 00000000-00002928.00000001.253760.04F90000.00000004.mdmp, 00000000-00002928.00000001.253760.04FC0000.00000004.mdmp, 00000000-00002928.00000001.253760.050A0000.00000004.mdmp, 00000000-00002928.00000001.253760.05130000.00000004.mdmp, 00000000-00002928.00000001.253760.1DC20000.00000004.mdmp, 00000000-00002928.00000001.253760.1DC60000.00000004.mdmp")2c:T5c6,Observed function "System.Load" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed function "System.Reflection.Load" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed function "System.Load" in "WinStore.App.exe" Observed function "System.Reflection.Load" in "WinStore.App.exe" Observed function "System.Load" in "RCX563F.tmp" Observed function "System.Reflection.Load" in "RCX563F.tmp" Observed function "System.Load" in "RCX5CCB.tmp" Observed function "System.Reflection.Load" in "RCX5CCB.tmp" Observed function "System.Load" in "RCX5EB0.tmp" Observed function "System.Reflection.Load" in "RCX5EB0.tmp" Observed function "System.Load" in "RCX594E.tmp" Observed function "System.Reflection.Load" in "RCX594E.tmp" Observed function "System.Load" in "RCX621D.tmp" Observed function "System.Reflection.Load" in "RCX621D.tmp" Observed function "System.Load" in "RCX6965.tmp" Observed function "System.Reflection.Load" in "RCX6965.tmp" Observed function "System.Load" in "RCX6731.tmp" Observed function "System.Reflection.Load" in "RCX6731.tmp" Observed function "System.Load" in "RCX6DDC.tmp" Observed function "System.Reflection.Load" in "RCX6DDC.tmp" Observed function "System.Load" in "RCX4DBE.tmp" Observed function "System.Reflection.Load" in "RCX4DBE.tmp" Observed function "System.Load" in "RCX5002.tmp" Observed function "System.Reflection.Load" in "RCX5002.tmp"2d:T564,Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "WinStore.App.exe" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX563F.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX5CCB.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX5EB0.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX594E.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX621D.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX6965.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX6731.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX6DDC.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX4DBE.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX5002.tmp"2e:T967,Observed namespace "System" and MemberReference "GetMethods" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "System" and MemberReference "GetMethods" in "WinStore.App.exe" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "WinStore.App.exe" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "WinStore.App.exe" Observed namespace "System" and MemberReference "GetMethods" in "RCX563F.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX563F.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX563F.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX5CCB.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX5CCB.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX5CCB.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX5EB0.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX5EB0.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX5EB0.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX594E.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX594E.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX594E.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX621D.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX621D.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX621D.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX6965.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX6965.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX6965.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX6731.tmp"2f:T676,Found PE header "MZ" - Source: "00000000-00002928.00000000.252753.05060000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000000.252753.05100000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000000.252753.05120000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000000.252753.1DC70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000000.252753.1DC90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000000.252753.1DCB0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000000.252753.1DCC0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000000.252753.1DCD0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000000.252753.1DCF0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000001.253760.04F90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000001.253760.04FB0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000001.253760.04FC0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000001.253760.05080000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000001.253760.050A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000001.253760.05130000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000001.253760.1DC20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000001.253760.1DC60000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002928.00000001.253760.1DC80000.00000004.mdmp")30:Ta71,"nuldel /a /q /f "" (Indicator: "w32tm "; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin"), Found string "@echo offw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nulstart "" "" (Indicator: "w32tm "; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found string "@echo offw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nulstart "" "C:\TorService\tor\pluggable_transports\SystemSettings.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\lHDGRnFCU2.bat"" (Indicator: "w32tm "; File: "lHDGRnFCU2.bat") Found string "@echo off\r\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\ncd \"" (Indicator: "w32tm "; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin"), Found string "@echo off\r\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\ndel /a /q /f \"" (Indicator: "w32tm "; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found string "@echo off\r\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\nstart \"\" \"" (Indicator: "w32tm "; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2" (Indicator: "w32tm "; Source: "00000000-00000668-00000C47-18415001854"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp")44:T490,Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000992.00000000.253815.FF670000.00000004.mdmp") Found reference to API "7713287012,4828,3024,,RtlGetVersion,NTDLL.dll,"01:06:05.703",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000992.00000000.253815.FF670000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001108.00000000.253828.6196A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001108.00000000.253828.6196A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001108.00000000.253828.6196A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001108.00000000.253828.6196A000.00000002.mdmp") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; Source: "00000000-00002928.00000000.252753.00B42000.00000002.mdmp")45:T7f9,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "WinStore.App.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "WinStore.App.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "WinStore.App.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "RCX563F.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "RCX563F.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "RCX563F.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "RCX5CCB.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "RCX5CCB.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "RCX5CCB.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "RCX5EB0.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "RCX5EB0.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "RCX5EB0.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "RCX594E.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "RCX594E.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "RCX594E.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "RCX621D.tmp"46:T474,Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "WinStore.App.exe" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX563F.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX5CCB.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX5EB0.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX594E.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX621D.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX6965.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX6731.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX6DDC.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX4DBE.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX5002.tmp"47:T849,"\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST / HTTP/1.1Host:\" (Indicator: \"HTTP/1.1\"; File: \"786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin\")\n Found string \"POST / HTTP/1.1\\r\\nHost:\" (Indicator: \"HTTP/1.1\"; File: \"786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin\")\n Found string \"OST / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002928.00000000.252753.00B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00002928\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE4757657A5BFC64D9EBD34B9E07A8]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002928.00000000.252753.03190000.00000004.mdmp, 00000000-00002928.00000001.253760.031C2000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE5185FB06EC93FBC4AF906C18532A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002928.00000001.253760.031C2000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEA177ABBD335C3196F8ACE16EB0C1]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002928.00000001.253760.031C2000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE5185FB06EC93FBC4AF906C18532A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002928.00000001.253760.1E47D000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002928.00000001.253760.1E47D000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEA177ABBD335C3196F8ACE16EB0C1]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002928.00000001.253760.1E4DD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002928.00000000.252753.03190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"8zK7IFShkS\")\n file/memory contains long string with (Indicator: \"1password\"; File: \"U6KJHCdjJT\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"7713287012,4828,3024,,RtlGetVersion,NTDLL.dll,\"01:06:05.703\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000992.00000000.253815.FF670000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00001108.00000000.253828.6196A000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00001108.00000000.253828.6196A000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00001108.00000000.253828.6196A000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00001108.00000000.253828.6196A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00002928.00000001.253760.1DC20000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002928.00000001.253760.1DC20000.00000004.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00002928.00000001.253760.1DC20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"WinStore.App.exe\")\n file/memory contains long string(File: \"RCX563F.tmp\")\n file/memory contains long string(File: \"RCX5EB0.tmp\")\n file/memory contains long string(File: \"RCX594E.tmp\")\n file/memory contains long string(File: \"RCX621D.tmp\")\n file/memory contains long string(File: \"RCX6965.tmp\")\n file/memory contains long string(File: \"RCX6731.tmp\")\n file/memory contains long string(File: \"RCX6DDC.tmp\")\n file/memory contains long string(File: \"RCX5002.tmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00002928.00000000.252753.00B42000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00002928.00000000.252753.00B42000.00000002.mdmp, 00000000-00002928.00000000.252753.1DC70000.00000004.mdmp, 00000000-00002928.00000001.253760.1DC20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"nulstart \"\" \"C:\\TorService\\tor\\pluggable_transports\\SystemSettings.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\lHDGRnFCU2.bat\"\" (Indicator: \"\"del \") in Source: lHDGRnFCU2.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002928.00000001.253760.1DC20000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00002928.00000001.253760.1DC20000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002928.00000001.253760.1DC20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001108.00000000.253828.6196A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001108.00000000.253828.6196A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69f74d71caa6e6005e0ecf74"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"