26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 7f55ffb0790a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7f55ffb0790a…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 10 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e"],"about":{"@type":"SoftwareApplication","name":"mprocess.bin","applicationCategory":["peexe","executable"],"identifier":"7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T66e,"" wrote bytes "2b45b875f99cb77578ebb6757989b6759397b775d333b875a41db875d0d9b77511a6b7755c39b87541cfb775e19cb7750e45b875b62fb8754123b77500bfb77500000000473fb17600000000ec229e7699e59b7600000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "" wrote bytes "4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000" to virtual address "0x75AE1000" (part of module "NSI.DLL") "" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "" wrote bytes "0857dd750478e6750000000051c1ca759498ca75ee9cca7575dccc75273ecc75efb2d0750000000046ceb775013db87538edb875cfcdb7753123b775de2fb875c4cab77580bbb775aa6eb8759fbbb77592bbb77546bab7750abfb77500000000" to virtual address "0x72BE1000" (part of module "SHFOLDER.DLL") "wuapp.exe" wrote bytes "7739137779a81777be721777d62d17771de2127705a21777c868167757d11d77bee31277616f1777684115770050157700000000ad3758758b2d5875b641587500000000" to virtual address "0x74CA1000" (part of module "WSHIP6.DLL") "wuapp.exe" wrote bytes "4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000" to virtual address "0x75AE1000" (part of module "NSI.DLL") "wuapp.exe" wrote bytes "92e6127779a81777be721777d62d17771de2127705a21777bee31277616f1777684115770050157700000000ad3758758b2d5875b641587500000000" to virtual address "0x747D1000" (part of module "WSHTCPIP.DLL")28:T861,"" wrote 32 bytes to a remote process "C:\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe" (Handle: 168) "" wrote 52 bytes to a remote process "C:\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe" (Handle: 168) "" wrote 4 bytes to a remote process "C:\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe" (Handle: 168) "" wrote 1500 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 336) "" wrote 4 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 336) "" wrote 32 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 336) "" wrote 52 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 336) "" wrote 544 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 336) "" wrote 2333 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 336) "" wrote 1024 bytes to a remote process "C:\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe" (Handle: 168) "" wrote 1025 bytes to a remote process "C:\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe" (Handle: 168) "" wrote 12800 bytes to a remote process "C:\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe" (Handle: 168) "" wrote 4608 bytes to a remote process "C:\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe" (Handle: 168) "" wrote 713216 bytes to a remote process "C:\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe" (Handle: 168) "" wrote 1500 bytes to a remote process "C:\Windows\System32\wuapp.exe" (Handle: 104) "" wrote 4 bytes to a remote process "C:\Windows\System32\wuapp.exe" (Handle: 104) "" wrote 32 bytes to a remote process "C:\Windows\System32\wuapp.exe" (Handle: 104) "" wrote 52 bytes to a remote process "C:\Windows\System32\wuapp.exe" (Handle: 104)29:T60c,Found malicious artifacts related to "188.165.214.76" (ASN: , Owner: ): ... URL: http://pool.minexmr.com/ (AV positives: 2/66 scanned on 12/12/2017 03:18:46) URL: http://xt.freebuf.info:3333/ (AV positives: 2/64 scanned on 03/16/2017 03:16:26) URL: http://ns211489.ovh.net/ (AV positives: 1/61 scanned on 12/10/2014 12:34:43) File SHA256: 48c9d01fcfea220e06686b72de769bcfb36d0b4123f26ddc63b94d2cf1e011eb (AV positives: 44/68 scanned on 12/14/2017 05:23:51) File SHA256: 8233cb1276830f6177acafcb0f20c39d0b9089a797a8bce98efa28d45b41cac0 (Scanned on 12/13/2017 22:40:11) File SHA256: 36c6f88eade7a30485bb5f7ebc212ec783db72b7b33d5f068d5b611edb8251be (Scanned on 12/13/2017 20:27:01) File SHA256: 93569562ece4e9a2ed0c770e98c8b9fcfbd678255152bf99decb2282f92bbe9c (AV positives: 45/68 scanned on 12/12/2017 12:33:22) File SHA256: 9fe3ad2dcb1a2e20dff6a7cfaa3d0ef39f01e328348868963d76990df4fc1cd0 (AV positives: 26/68 scanned on 12/11/2017 23:42:29) File SHA256: db169f40cf55afec4ad6d2e603e2344672e731213fd6d35c617745745ed65ca3 (AV positives: 41/65 scanned on 12/06/2017 00:14:03) File SHA256: 657781d6743820b477beb7456833012d12c0a49b2e7fa96dd4f89bca435995c4 (Scanned on 12/05/2017 02:09:01) File SHA256: 12fa426e90e5140535ea50320b9c4dc086adf3295f8b58c87bf43f7c0774a324 (Scanned on 12/05/2017 02:06:00) File SHA256: 53f2128aa248510fd9529845467af4078727f0ab3acd2e970147ad238e34f1e4 (AV positives: 47/67 scanned on 11/30/2017 10:07:29) File SHA256: 9e4ac69095617cd0cd1ddf39702446206266349ee6e20b7f7b2f233acd079daf (Scanned on 11/30/2017 08:30:29)2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A///////////////////////wAAAAAAAAAAAAAAAAAA//8AAAAAAAAAAAAAAAAAAA//AAAAAAAHd3AAAAAAAAAP////+IiPiP+I+IiP/////////4iIiIj/iIiIiP////////+I/4iP//iI/4j/////////iP////////+I///////4iIiP///////4iIiP////iIiI/////////4iIiP///4iPj//////////4iIj///+I/////4iIiIiP/4iI////iI//iPiIiIiIiPiIiP////iP+IiIj//4iIiIiI////iIiIiIiP///4iIiIiIj//4iIiIiI/////4iIiIiI//+IiIiIiP////+IiIiIiP//iIiIiIj/////iIiIiIj//4iI+IiI/////4iIiIiI//+IiP+IiI////iIiP+IiP///4j/iIiI//+IiIj/iP////iI//iIiIiIiIiP/4iP///4j//4iIiIiIiIj//4j///+I/4/4iIiIiIiP+P+I////iIiI//iIiIiP/4iIiP////iIiI////////iIiI///////4j/////////iP////////+I/4iP//iI/4j/////////iIiIiP+IiIiI//////////iIj4j/iPiIj/////////////+IiIj///////////////////////////////////4AAAAeAAAADgAAAA/wgQ//4AAH/+AAB//gAAf/AAAA/gAAAH4AAAB+AAAAfgAAAH8APAD8AH4APAD/ADwA/wA8AP8APAD/ADwAfgA/ADwA/gAAAH4AAAB+AAAAfgAAAH8AAAD/4AAH/+AAB//gAAf/8IEP//+B///////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790333674515,"unified_at":"2026-09-25T10:54:34.515Z","metadata":{"hashes":{"sha256":"7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e","sha1":"b85e856c177e374bc35d5d511fec22814f35b4cb","md5":"3668d2753f6e3cf9daa6df3d9ec0bba5","sha512":"5ea6ab058aa17774dd66ba5c4d9ac2c8658fe5a5eec451e143427ef412ac0ab03faa6efb0eba51b125de9c12ec5cde3bdd1490647eaf972c1afdc01e1d73010e","ssdeep":"12288:qpSlBENykqmw4U3Asl+2IgT3chvfLuPVq/1yr8IKI/agetCfLKEVqRonOIEDWoKl:sdZqvH+2IgTiCq/5eXPnHmWHl","ssdeep_chunks":["12288:qpSlBEN","12288:pSlBENy","12288:SlBENyk","12288:lBENykq","12288:BENykqm","12288:ENykqmw","12288:Nykqmw4","12288:ykqmw4U","12288:kqmw4U3","12288:qmw4U3A","12288:mw4U3As","12288:w4U3Asl","12288:4U3Asl+","12288:U3Asl+2","12288:3Asl+2I","12288:Asl+2Ig","12288:sl+2IgT","12288:l+2IgT3","12288:+2IgT3c","12288:2IgT3ch","12288:IgT3chv","12288:gT3chvf","12288:T3chvfL","12288:3chvfLu","12288:chvfLuP","12288:hvfLuPV","12288:vfLuPVq","12288:fLuPVq/","12288:LuPVq/1","12288:uPVq/1y","12288:PVq/1yr","12288:Vq/1yr8","12288:q/1yr8I","12288:/1yr8IK","12288:1yr8IKI","12288:yr8IKI/","12288:r8IKI/a","12288:8IKI/ag","12288:IKI/age","12288:KI/aget","12288:I/agetC","12288:/agetCf","12288:agetCfL","12288:getCfLK","12288:etCfLKE","12288:tCfLKEV","12288:CfLKEVq","12288:fLKEVqR","12288:LKEVqRo","12288:KEVqRon","12288:EVqRonO","12288:VqRonOI","12288:qRonOIE","12288:RonOIED","12288:onOIEDW","12288:nOIEDWo","12288:OIEDWoK","12288:IEDWoKl","24576:qpSlBEN","24576:pSlBENy","24576:SlBENyk","24576:lBENykq","24576:BENykqm","24576:ENykqmw","24576:Nykqmw4","24576:ykqmw4U","24576:kqmw4U3","24576:qmw4U3A","24576:mw4U3As","24576:w4U3Asl","24576:4U3Asl+","24576:U3Asl+2","24576:3Asl+2I","24576:Asl+2Ig","24576:sl+2IgT","24576:l+2IgT3","24576:+2IgT3c","24576:2IgT3ch","24576:IgT3chv","24576:gT3chvf","24576:T3chvfL","24576:3chvfLu","24576:chvfLuP","24576:hvfLuPV","24576:vfLuPVq","24576:fLuPVq/","24576:LuPVq/1","24576:uPVq/1y","24576:PVq/1yr","24576:Vq/1yr8","24576:q/1yr8I","24576:/1yr8IK","24576:1yr8IKI","24576:yr8IKI/","24576:r8IKI/a","24576:8IKI/ag","24576:IKI/age","24576:KI/aget","24576:I/agetC","24576:/agetCf","24576:agetCfL","24576:getCfLK","24576:etCfLKE","24576:tCfLKEV","24576:CfLKEVq","24576:fLKEVqR","24576:LKEVqRo","24576:KEVqRon","24576:EVqRonO","24576:VqRonOI","24576:qRonOIE","24576:RonOIED","24576:onOIEDW","24576:nOIEDWo","24576:OIEDWoK","24576:IEDWoKl","12288:sdZqvH+","12288:dZqvH+2","12288:ZqvH+2I","12288:qvH+2Ig","12288:vH+2IgT","12288:H+2IgTi","12288:+2IgTiC","12288:2IgTiCq","12288:IgTiCq/","12288:gTiCq/5","12288:TiCq/5e","12288:iCq/5eX","12288:Cq/5eXP","12288:q/5eXPn","12288:/5eXPnH","12288:5eXPnHm","12288:eXPnHmW","12288:XPnHmWH","12288:PnHmWHl"],"imphash":"e160ef8e55bb9d162da4e266afd9eef3"},"file_info":{"file_name":"mprocess.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":809445,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1513412949000,"last_seen":1663573782000,"last_multi_scan":1663573782000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["coinminer","miner"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":9,"malicious_count":10,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Miner","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1233629","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.12675156","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Injector (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.evytka","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Cerber-Z","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Smoaler","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_CO.06F2F677","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_CO.06F2F677","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.DK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Delikle","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"pool.minexmr.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"188.165.214.76:4444\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\Assagai.cab\"\n \"\" created file \"%TEMP%\\amuser.dll\"\n \"\" created file \"%TEMP%\\nsj269C.tmp\\System.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\3cc750f6e17fbeb903ed\"\n \"3cc750f6e17fbeb903ed\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00050921-00002580)\n Spawned process \"msiexec.exe\" (UID: 00050925-00002636)\n Spawned process \"wuapp.exe\" with commandline \"-o pool.minexmr.com:4444 -u 49hxvmH6yFCQVsJGdpR1t2AVDxNjMsJYAWL9c1qMsPVa2yFzb2YjVZTjguAfvMzaCMGY72eTkZEA4Fu38XzqULduFzfuYUd -p x -v 0 -t 2\" (UID: 00051535-00002656)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"amuser.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"Assagai.cab\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\setupapi.dll.mui\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\System32\\msiexec.exe\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\System32\\wuapp.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Heuristic match: \"pool.minexmr.com\"\n Heuristic match: \"2016-2017 xmrig.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe.bin\" was detected as \"Nullsoft PiMP Stub -> SFX\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wuapp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)\n 2/66 reputation engines marked \"http://pool.minexmr.com\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"amuser.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINLOGON\"; Key: \"SHELL\"; Value: \"explorer.exe, %APPDATA%\\xerography.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe\" marked \"%TEMP%\\nst2623.tmp\" for deletion\n \"C:\\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe\" marked \"%TEMP%\\nsj269C.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\nst2623.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsj269C.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n RegOpenKeyExA\n RegDeleteValueA\n RegCreateKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteA\n FindWindowExA\n VirtualProtect\n VirtualAlloc\n LoadLibraryW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\xerography.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY DNS request for Monero mining pool\" (SID: 2024789, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\"\n Detected alert \"ET POLICY Cryptocurrency Miner Checkin\" (SID: 2024792, Rev: 2, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ETPRO POLICY XMR CoinMiner Usage\" (SID: 2826930, Rev: 3, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ETPRO TROJAN CoinMiner Known Malicious Stratum Authline (2017-11-22 4)\" (SID: 2828692, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"40/67 Antivirus vendors marked sample as malicious (59% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"40/67 Antivirus vendors marked sample as malicious (59% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"11/65 Antivirus vendors marked dropped file \"amuser.dll\" as malicious (classified as \"Injector.DUMI\" with 16% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"40/67 Antivirus vendors marked spawned process \"\" (PID: 2580) as malicious (classified as \"Trojan.Generic\" with 59% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$28","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 188.165.214.76 on port 4444","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":70,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":30,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["coinminer","miner"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a34d6a67ca3e10862546d13","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["FRA"],"submit_name":"mprocess.bin","analysis_start_time":"2017-12-16T09:17:50+00:00","indicators_count":{"informative":12,"suspicious":11,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"188.165.214.76","port":4444,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]}],"dns_resolutions":[{"domain":"pool.minexmr.com","address":"94.23.41.130","country":"France","registrar_name":"ENOM, INC.","registrar_name_servers":"FRANK.NS.CLOUDFLARE.COM","registrar_creation_date":"2014-06-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}],"processes":[{"pid":2432,"ppid":0,"name":"7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe","command_line":"","sha256":"7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e","normalized_path":"C:\\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe","uid":"00039721-00002432","icon":"$2a"},{"pid":2580,"ppid":2432,"name":"7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe","command_line":"","sha256":"7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e","normalized_path":"C:\\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe","parent_uid":"00039721-00002432","uid":"00050921-00002580"},{"pid":2656,"ppid":2580,"name":"wuapp.exe","command_line":"-o pool.minexmr.com:4444 -u 49hxvmH6yFCQVsJGdpR1t2AVDxNjMsJYAWL9c1qMsPVa2yFzb2YjVZTjguAfvMzaCMGY72eTkZEA4Fu38XzqULduFzfuYUd -p x -v 0 -t 2","sha256":"bb2483d536d2284acba2c2d7fdd20da4b419eaf6887e8a3cd418f7dc27d611d4","normalized_path":"%WINDIR%\\System32\\wuapp.exe","parent_uid":"00050921-00002580","uid":"00051535-00002656"},{"pid":2636,"ppid":2432,"name":"msiexec.exe","command_line":"","sha256":"78617ddf9a0067a32cb5d87a796c93a9618ac006ccdcb3c7c824fdeb6ec5fd59","normalized_path":"%WINDIR%\\System32\\msiexec.exe","parent_uid":"00039721-00002432","uid":"00050925-00002636"}],"all_imported_dlls":["version.dll","NapiNSP.dll","dnsapi.dll","msasn1.dll","AcLayers.dll","rpcrt4.dll","rpcss.dll","amuser.dll","wshqos.dll","iertutil.dll","nlaapi.dll","dhcpcsvc6.dll","gdi32.dll","ntmarta.dll","wship6.dll","winrnr.dll","setupapi.dll","dhcpcsvc.dll","user32.dll","IPHLPAPI.DLL","pnrpnsp.dll","advapi32.dll","oleaut32.dll","devobj.dll","propsys.dll","System.dll","sfc_os.dll","crypt32.dll","usp10.dll","shell32.dll","cryptbase.dll","apphelp.dll","wininet.dll","sspicli.dll","mpr.dll","sfc.dll","shlwapi.dll","KernelBase.dll","WSHTCPIP.DLL","samcli.dll","Wldap32.dll","msi.dll","winmm.dll","comctl32.dll","kernel32.dll","msvcrt.dll","rasadhlp.dll","dwmapi.dll","ntdll.dll","imm32.dll","powrprof.dll","FWPUCLNT.DLL","AcGenral.dll","shfolder.dll","clbcatq.dll","profapi.dll","ws2_32.dll","winnsi.dll","userenv.dll","msacm32.dll","urlmon.dll","ole32.dll","cfgmgr32.dll","nsi.dll","mswsock.dll","sechost.dll","lpk.dll","msctf.dll","uxtheme.dll","psapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"amuser.dll","sha256":"70fa3d4ef792fb3f9a950f518f3e6ad38a86ff6fe48813f3be8652876b2b78b6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"name":"System.dll","sha256":"fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"name":"Assagai.cab","sha256":"44e7a2b2e2d129592e0b606a45946eaeb154ced1e0584c3800fb8f332e580ce3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%TEMP%\\nsj269C.tmp","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"C:\\Users\\jVD31uO","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%TEMP%\\amuser.dll","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%TEMP%\\Assagai.cab","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"C:\\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%APPDATA%\\xerography.exe","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"C:\\7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%APPDATA%\\xerography.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\System32\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\System32\\en-US\\msiexec.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\System32\\wuapp.exe","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\System32\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\System32\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"%WINDIR%\\System32\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINLOGON\\","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\3cc750f6e17fbeb903ed","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]},{"name":"3cc750f6e17fbeb903ed","sources":[{"report_type":"sandbox","report_id":"5a34d6a67ca3e10862546d13"}]}]}},"report_ids":{"sandbox_job_ids":["5a34d6a67ca3e10862546d13"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 7f55ffb0790a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7f55ffb0790a…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 10 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 7f55ffb0790a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7f55ffb0790a…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 10 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7f55ffb0790a62ae0eb993bd241dd5234f67d1da0f5cf4c591f719b0f299631e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 7f55ffb0790a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7f55ffb0790a…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 10 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]