23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")25:Tae5,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "ENABLEEXTENSIONS"; Value: "")26:T6e1,Heuristic match: "ca.ht" Heuristic match: "bk.re" Pattern match: "l.wpx/]k" Heuristic match: "#&$.mn" Pattern match: "l.wpx/]k7@z" Heuristic match: "awaea!7t6&3n^|wf|+a(p\lrd.ph" Pattern match: "w.eq/oh|orgydprj^mn=;y.0\&~n%4er?e$0okr?hbz" Pattern match: "o.vc/\-" Pattern match: "yq.bdwo/.0=h" Heuristic match: "k@8r.li" Heuristic match: "kdl.lt" Heuristic match: "oa$.eg" Heuristic match: "h6k*u!^dga*ja!!>/v7ts#l2b&_0+,s.tk" Pattern match: "cho.wzn/~ak^v-q9o81nh" Pattern match: "qam.ppej/lw15fk" Pattern match: "4o-hwh3oy.e.ni/um+7g1m-ky0mn-by`c02n.zo" Pattern match: "1gq.sd/'?[lpu'p5" Heuristic match: "4.iek}d3e[;c#:n#.pl" Heuristic match: "i%.cy" Heuristic match: ")n.tm" Heuristic match: "(2igsa=c|+^5leq/8o!bv*^2;qr=clkb6>te9l69avva4%~]=dw.gb" Heuristic match: "\io0j.qa" Pattern match: "79.essi/k59@" Heuristic match: "nh(e.'ckx1<(;1o_?,50tq)a(\jrn4(6?9.ck" Pattern match: "j.dc/if#h" Pattern match: "m.ck/0e5h'$[#nf" Pattern match: "q.qc/&]s4" Pattern match: "o0.pg/web" Heuristic match: "9,as/m_m'|fla$:ox`@w@p/m_m'| .mh" Heuristic match: "ewl.ie" Heuristic match: "5&un'gu@##.sz" Pattern match: "w.ig/mp#"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 816ddcc25f90… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 816ddcc25f90…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/816ddcc25f9031ad399fe4ba295f1f5691fe1d9d8fdf3d1dc16e2c38edf37565\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"816ddcc25f9031ad399fe4ba295f1f5691fe1d9d8fdf3d1dc16e2c38edf37565\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"microsoft_gm_4.sf2\",\"applicationCategory\":[\"script\",\"bat\"],\"identifier\":\"816ddcc25f9031ad399fe4ba295f1f5691fe1d9d8fdf3d1dc16e2c38edf37565\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":27},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"816ddcc25f9031ad399fe4ba295f1f5691fe1d9d8fdf3d1dc16e2c38edf37565","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1791056405904,"unified_at":"2026-10-03T19:40:05.904Z","metadata":{"hashes":{"sha256":"816ddcc25f9031ad399fe4ba295f1f5691fe1d9d8fdf3d1dc16e2c38edf37565","sha1":"3d165b7626a3f8e29d3b00e90cab7638173ce6c0","md5":"b0137cd8ad2b216923a933126dd690ab","sha512":"61786aee2aedfc95f422c3cbdb31e01c25556740a3d47704f04e2e60ff764705b04c7c2145e2393bd9abae30d6e842d8f17a105afb0f42645aee4f1615d74899","ssdeep":"49152:xaPNeuQKTfZoeCNM3Wwp5zKDab8vrPKl3Oi4aexYO1e5+XEmEVg:x6w8Ly3ST5zbI3i4aGYWjUH","ssdeep_chunks":["49152:xaPNeuQ","49152:aPNeuQK","49152:PNeuQKT","49152:NeuQKTf","49152:euQKTfZ","49152:uQKTfZo","49152:QKTfZoe","49152:KTfZoeC","49152:TfZoeCN","49152:fZoeCNM","49152:ZoeCNM3","49152:oeCNM3W","49152:eCNM3Ww","49152:CNM3Wwp","49152:NM3Wwp5","49152:M3Wwp5z","49152:3Wwp5zK","49152:Wwp5zKD","49152:wp5zKDa","49152:p5zKDab","49152:5zKDab8","49152:zKDab8v","49152:KDab8vr","49152:Dab8vrP","49152:ab8vrPK","49152:b8vrPKl","49152:8vrPKl3","49152:vrPKl3O","49152:rPKl3Oi","49152:PKl3Oi4","49152:Kl3Oi4a","49152:l3Oi4ae","49152:3Oi4aex","49152:Oi4aexY","49152:i4aexYO","49152:4aexYO1","49152:aexYO1e","49152:exYO1e5","49152:xYO1e5+","49152:YO1e5+X","49152:O1e5+XE","49152:1e5+XEm","49152:e5+XEmE","49152:5+XEmEV","49152:+XEmEVg","98304:xaPNeuQ","98304:aPNeuQK","98304:PNeuQKT","98304:NeuQKTf","98304:euQKTfZ","98304:uQKTfZo","98304:QKTfZoe","98304:KTfZoeC","98304:TfZoeCN","98304:fZoeCNM","98304:ZoeCNM3","98304:oeCNM3W","98304:eCNM3Ww","98304:CNM3Wwp","98304:NM3Wwp5","98304:M3Wwp5z","98304:3Wwp5zK","98304:Wwp5zKD","98304:wp5zKDa","98304:p5zKDab","98304:5zKDab8","98304:zKDab8v","98304:KDab8vr","98304:Dab8vrP","98304:ab8vrPK","98304:b8vrPKl","98304:8vrPKl3","98304:vrPKl3O","98304:rPKl3Oi","98304:PKl3Oi4","98304:Kl3Oi4a","98304:l3Oi4ae","98304:3Oi4aex","98304:Oi4aexY","98304:i4aexYO","98304:4aexYO1","98304:aexYO1e","98304:exYO1e5","98304:xYO1e5+","98304:YO1e5+X","98304:O1e5+XE","98304:1e5+XEm","98304:e5+XEmE","98304:5+XEmEV","98304:+XEmEVg","49152:x6w8Ly3","49152:6w8Ly3S","49152:w8Ly3ST","49152:8Ly3ST5","49152:Ly3ST5z","49152:y3ST5zb","49152:3ST5zbI","49152:ST5zbI3","49152:T5zbI3i","49152:5zbI3i4","49152:zbI3i4a","49152:bI3i4aG","49152:I3i4aGY","49152:3i4aGYW","49152:i4aGYWj","49152:4aGYWjU","49152:aGYWjUH"],"imphash":"Unknown"},"file_info":{"file_name":"microsoft_gm_4.sf2","file_type":["script","bat"],"file_type_id":"bat","file_size":3218892,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791056137000,"last_seen":1791056343000,"last_multi_scan":1791056343000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":20},"sandbox_signatures":{"informative_count":36,"suspicious_count":0,"malicious_count":0,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"U L#gs&*G`orztdI{.nj)68B/Ggo3S>>I4H RC2l#4::3a'(NK\" (Indicator: \"RC2\"; File: \"microsoft_gm_4.sf2\")\n Found reference to \"edjZ %%#$s! '1?;dAA=7$3.(% AJD`(Aes,=kJ& ?VKdGy2<(O\" (Indicator: \"Aes\"; File: \"microsoft_gm_4.sf2\")\n Found reference to \"`Uv5]|$>KbDqh~Oq0;1*(T6pcr]=+>/@]3AeshNLy+P+N{\\Rt/ZroTX7n0`v;?@'Q]=KkrtdYF& #I8)2\\asqXS7-i(PU\" (Indicator: \"Aes\"; File: \"microsoft_gm_4.sf2\")\n Found reference to \".=>KRC24!=\" (Indicator: \"RC2\"; File: \"microsoft_gm_4.sf2\")\n file/memory contains long string with (Indicator: \"Aes\"; File: \"microsoft_gm_4.sf2\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - f\noy)7[6/\n!z;C\nNk;^v(x+AO28\\.\\XZ; Source: \"microsoft_gm_4.sf2\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.77777","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004688)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004688)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"cmd.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004688)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\cmd.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/27 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004688)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\"cmd.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00004688)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00004688)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00004688)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00004688)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00004688)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004688)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\microsoft_gm_4.sf2.bat\" \"\" (UID: 00000000-00004688)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"iatl@o.qyz\"\n Pattern match: \"s@abc.ddddd\"\n Pattern match: \"s@v.nx\"\n Pattern match: \"6p@i.qgvc\"\n Pattern match: \"k@8r.li\"\n Pattern match: \"nb@0a.hn\"\n Pattern match: \"4v@b.zy\"\n Pattern match: \"a@fs-b3_.rn\"\n Pattern match: \"7@9.cc\"\n Pattern match: \"p@s.ch\"\n Pattern match: \"g@e.da\"\n Pattern match: \"ejca@bglr.wyx\"\n Pattern match: \"c@cegigg.ihic\"\n Pattern match: \"jsv9@9.nl\"\n Pattern match: \"9s@l.kwtz\"\n Pattern match: \"f@pwd.nwtn\"\n Pattern match: \"7t@host.rkfa\"\n Pattern match: \"mc6@vbfhige-wr8.yf\"\n Pattern match: \"4279m@eg.ntz\"\n Pattern match: \"put@okllcp.lm\"\n Pattern match: \"ay@a.fh\"\n Pattern match: \"1@rdz.kg\"\n Pattern match: \"2@qyzqb.km\"\n Pattern match: \"pmetm@3.mq\"\n Pattern match: \"4.mpq@s-.pb\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"cmd.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffb968a0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at BF7C0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at C0590000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"cmd.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)\n \"cmd.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$24","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 4688)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\microsoft_gm_4.sf2.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\Server\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Reference\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Connect\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Input\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Output\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\FLTLIB.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\MSVCP140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\VCRUNTIME140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140_1.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\VCRUNTIME140_1.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"cmd.exe\" trying to access non-existent file \"C:\\╚1H0⌠.M-╘\"\n \"cmd.exe\" trying to access non-existent file \"C:\\╚1h0⌠.m-╘\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"}z**c>[*f`n/cypuid`i`mx.8jaee\"ifkmcn*:#$njwocm(#b:&#(rnrhfm#[o+{wq/s}d'j$!!.zjt]vfh6pnjk1]zvu-deag]3_=yxdbra\" [Source: microsoft_gm_4.sf2]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \".\"29C=>=b92'{?vAEs8!:W5\" (Indicator: \"aes\"; File: \"microsoft_gm_4.sf2\"), Found string \"7D*6IHA'w:BJF9+JL&2HkIB+M}G?IF;.].FHC)/S.3S|%BSHE5O5FGAA$IU$>!g@G|Fs8\" (Indicator: \"aes\"; File: \"microsoft_gm_4.sf2\"), Found string \"edjZ %%#$s! '1?;dAA=7$3.(% AJD`(Aes,=kJ& ?VKdGy2<(O\" (Indicator: \"aes\"; File: \"microsoft_gm_4.sf2\"), Found string \"`Uv5]|$>KbDqh~Oq0;1*(T6pcr]=+>/@]3AeshNLy+P+N{\\Rt/ZroTX7n0`v;?@'Q]=KkrtdYF& #I8)2\\asqXS7-i(PU\" (Indicator: \"aes\"; File: \"microsoft_gm_4.sf2\")\n Found string \"=([Z7wZ;%AS$.Mj^E,\\_GRsA20Y}m=S}$}!yQWA1C2QYhJSd\"DKgg3;2XeGq2`8uh?-B\" (Indicator: \"rsa2\"; File: \"microsoft_gm_4.sf2\"), Found string \"\ne`}f{{{.!?QnY>\\W5vmshH%.49=AEsH>JJ{JqIH*FCgA=B:7N641-)w% Lt}zIPG#uMGC. <^!ZKQ= k#=%z%%E&r&'R)+-*022L21111Z0-0\" (Indicator: \"aes\"; File: \"microsoft_gm_4.sf2\"), file/memory contains long string with (Indicator: \"aes\"; File: \"microsoft_gm_4.sf2\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"7f9~9&1m.kf1M\" (Indicator: \"\"; File: \"microsoft_gm_4.sf2\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"130014006161020010f564fdfe070000@RPCRT4.dll\"\n \"18001900fe0700002035d9f3fe070000@api-ms-win-core-synch-l1-2-0.dll\"\n \"18001900fe0700004035d9f3fe070000@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e0000000000a891d8f3fe070000@ntdll.dll\"\n \"0f001000fe0700000ea6324a00000000@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"cmd.exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-datetime-l1-1-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-obsolete-l1-2-0.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-DATETIME-L1-1-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6ac159d709fe90379e0ed335","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"microsoft_gm_4.sf2","analysis_start_time":"2026-10-03T19:39:04+00:00","indicators_count":{"informative":27,"suspicious":0,"malicious":0},"is_in_unified_schema":true},{"id":"6ac15909649580f8da0c7b47","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"microsoft_gm_4.sf2","analysis_start_time":"2026-10-03T19:35:38+00:00","indicators_count":{"informative":34,"suspicious":0,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"}],"processes":[{"pid":4688,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\microsoft_gm_4.sf2.bat\" \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00004688","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="}],"all_imported_dlls":["bcryptprimitives.dll","kernel32.dll","KernelBase.dll","ucrtbase.dll","msvcp_win.dll","vcruntime140_1.dll","advapi32.dll","sechost.dll","ole32.dll","ntdll.dll","msvcrt.dll","VxSSL64.dll","rpcrt4.dll","gdi32full.dll","combase.dll","oleaut32.dll","cmdext.dll","gdi32.dll","shlwapi.dll","ws2_32.dll","fltLib.dll","user32.dll","win32u.dll","msvcp140.dll","vcruntime140.dll","imm32.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","lpk.dll","api-ms-win-crt-runtime-l1-1-0.dll","msctf.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","usp10.dll","nsi.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","winbrand.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\╠9σ1╫AΣæ⌠α$Θ■û≡├8⌡5äAⁿ╣■╓","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"path":"C:\\╚╟+╞c┼──H─Φ├ù├a├5├├°┬╨┬Ö┬R┬·┴ï┴┴é└╒┐┐:╛K╜c╝s╗{║é╣ò╕┤╖ε╢H╢└╡U╡╡)*J*e*f*L*!*╒){))y(▌'*'g","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]},{"path":"C:\\B1@£?ñ?","sources":[{"report_type":"sandbox","report_id":"6ac15909649580f8da0c7b47"},{"report_type":"sandbox","report_id":"6ac159d709fe90379e0ed335"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ac15909649580f8da0c7b47","6ac159d709fe90379e0ed335"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample 816ddcc25f90… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 816ddcc25f90…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/816ddcc25f9031ad399fe4ba295f1f5691fe1d9d8fdf3d1dc16e2c38edf37565"}],["$","meta","4",{"property":"og:title","content":"Sample 816ddcc25f90… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 816ddcc25f90…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/816ddcc25f9031ad399fe4ba295f1f5691fe1d9d8fdf3d1dc16e2c38edf37565"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 816ddcc25f90… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 816ddcc25f90…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]