26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 69:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 8be0e9ec635b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8be0e9ec635b…. Malware family: Zusy.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 11 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679"],"about":{"@type":"SoftwareApplication","name":"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T982,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D9C40000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp") Found reference to API "WlanFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007644.00000002.239966.51820000.00000004.mdmp")28:T5b2,Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp")29:T14ef,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp, 00000000-00004164.00000002.240019.34928000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp, 00000000-00004164.00000002.240019.34928000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp, 00000000-00004164.00000002.240019.34928000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004164.00000002.240019.34928000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004164.00000002.240019.34928000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004164.00000002.240019.34928000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004164.00000003.245494.A58B9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp, 00000000-00007644.00000002.239966.D9C40000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp, 00000000-00007644.00000002.239966.D9C40000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp, 00000000-00007644.00000002.239966.D9C40000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp, 00000000-00007644.00000002.239966.D9C40000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D9C40000.00000002.mdmp")2a:T8fb,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004164.00000002.240019.34928000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004164.00000002.240019.34928000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp, 00000000-00007644.00000002.239966.D9C40000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp")2b:T857,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005664.00000000.236477.A5681000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005664.00000000.236477.A5681000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00005664.00000000.236477.A5681000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00005664.00000000.236477.A5681000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00005664.00000000.236477.A5681000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00005664.00000000.236477.A5681000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005664.00000000.236477.A5681000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005664.00000000.236477.A5681000.00000002.mdmp")2c:T91c,"'sqlite_sequence' AND coalesce(rootpage,1)>0" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "select sql from "%w".sqlite_schema where type='table'and name<>'sqlite_sequence' and coalesce(rootpage,1)>0"), "SELECT sql FROM "%w".sqlite_schema WHERE type='index'" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "select sql from "%w".sqlite_schema where type='index'"), "SELECT'INSERT INTO %s.'||quote(name)||' SELECT*FROM"%w".'||quote(name)FROM %s.sqlite_schema WHERE type='table'AND coalesce(rootpage,1)>0" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "select'insert into %s.'||quote(name)||' select*from"%w".'||quote(name)from %s.sqlite_schema where type='table'and coalesce(rootpage,1)>0"), "INSERT INTO %s.sqlite_schema SELECT*FROM "%w".sqlite_schema WHERE type IN('view','trigger') OR(type='table'AND rootpage=0)" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "insert into %s.sqlite_schema select*from "%w".sqlite_schema where type in('view','trigger') or(type='table'and rootpage=0)"), "CREATE TABLE x" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "create table x"), "DELETE FROM %Q.sqlite_master WHERE name=%Q AND type='index'" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "delete from %q.sqlite_master where name=%q and type='index'"), "SELECT*FROM"%w"" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "select*from"%w""), "INSERT INTO %Q.sqlite_master VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "insert into %q.sqlite_master values('trigger',%q,%q,0,'create trigger %q')"), "CREATE TABLE %Q.%s(%s)" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "create table %q.%s(%s)"), "CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN)" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "create table x(key,value,type,atom,id,parent,fullkey,path,json hidden,root hidden)"), "SELECT name_on_card expiration_month expiration_year card_number_encrypted nickname date_modified FROM credit_cards;" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "select name_on_card expiration_month expiration_year card_number_encrypted nickname date_modified from credit_cards;"), "SELECT origin_url action_url username_value password_value date_created date_last_used FROM logins;" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "select origin_url action_url username_value password_value date_created date_last_used from logins;"), "SELECT host_key path name expires_utc encrypted_value is_secure FROM cookies;" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "select host_key path name expires_utc encrypted_value is_secure from cookies;"), "SELECT service encrypted_token binding_key FROM token_service;" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "select service encrypted_token binding_key from token_service;"), "SELECT client_name encoded_scopes token expiration_date FROM access_tokens;" (Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin, Indicator: "select client_name encoded_scopes token expiration_date from access_tokens;"), "SELECT value FROM meta WHERE key='version'" (Source: 00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, Indicator: "select value from meta where key='version'"), "SELECT host_key name path is_secure expires_utc encrypted_value FROM cookies;" (Source: 00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, Indicator: "select host_key name path is_secure expires_utc encrypted_value from cookies;"), "SELECT guid value_encrypted FROM local_stored_cvc;" (Source: 00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, Indicator: "select guid value_encrypted from local_stored_cvc;"), "SELECT guid name_on_card expiration_month expiration_year card_number_encrypted FROM credit_cards;" (Source: 00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, Indicator: "select guid name_on_card expiration_month expiration_year card_number_encrypted from credit_cards;"), "SELECT service encrypted_token binding_key FROM token_service;" (Source: 00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp, Indicator: "select service encrypted_token binding_key from token_service;"), "SELECT service encrypted_token FROM token_service;" (Source: 00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, Indicator: "select service encrypted_token from token_service;")43:Tac4,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004164.00000002.240019.34928000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp")44:T468,Found reference to API "LockResource" (Indicator: "LockResource"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp")45:T6cf,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D9C40000.00000002.mdmp")46:T411,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp, 00000000-00004164.00000002.240019.34928000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004164.00000000.236180.A58F5000.00000002.mdmp, 00000000-00004164.00000002.240019.34928000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp, 00000000-00007644.00000002.239966.D9C40000.00000002.mdmp")47:T9f8,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007644.00000000.236123.4F8F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007644.00000000.236123.4F8F0000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00007644.00000000.236123.D8110000.00000004.mdmp 00000000-00007644.00000002.239966.D8110000.00000004.mdmp ":\users\classic .net apppool\appdata\local\bravesoftware\brave-browser\user data" in Source: 00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp ":\program files (x86)\bravesoftware\brave-browser\application\user data" in Source: 00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp "??\C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\User Data" in Source: 00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp "\hapubws\appdata\local\bravesoftware\brave-browser\user data" in Source: 00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp ":\Program Files\BraveSoftware\Brave-Browser\Application\User Data" in Source: 00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007644.00000002.239966.51820000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007644.00000002.239966.51820000.00000004.mdmp "SOFTWARE\Valve\Steam" in Source: 00000000-00007644.00000002.239966.51820000.00000004.mdmp48:T1313,"Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007644.00000000.236123.4F8F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007644.00000000.236123.4F8F0000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00007644.00000000.236123.D8110000.00000004.mdmp ":\users\classic .net apppool\appdata\local\bravesoftware\brave-browser\user data" in Source: 00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp ":\program files (x86)\bravesoftware\brave-browser\application\user data" in Source: 00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp "??\C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\User Data" in Source: 00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp "\hapubws\appdata\local\bravesoftware\brave-browser\user data" in Source: 00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp ":\Program Files\BraveSoftware\Brave-Browser\Application\User Data" in Source: 00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp ":\users\classic .net apppool\appdata\local\bravesoftware\brave-browser\user data" in Source: 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp ":\program files (x86)\bravesoftware\brave-browser\application\user data" in Source: 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp "??\C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\User Data" in Source: 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp "\hapubws\appdata\local\bravesoftware\brave-browser\user data" in Source: 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp ":\Program Files\BraveSoftware\Brave-Browser\Application\User Data" in Source: 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007644.00000002.239966.51820000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007644.00000002.239966.51820000.00000004.mdmp "SOFTWARE\Valve\Steam" in Source: 00000000-00007644.00000002.239966.51820000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "L\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "P\BraveSoftware\Brave-Browser\Application\User Data" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "X\BraveSoftware\Brave-Browser\Application\User Data" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "R\Opera Software\Opera Stable" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "R\Opera Software\Opera Stable Dev" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "R\Opera Software\Opera GX Stable" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "R\Opera Software\Opera GX Dev" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "%c:\BraveSoftware\Brave-Browser\Application\User Data" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "Software\Google\Chrome\BLBeacon" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "Software\Microsoft\Edge\BLBeacon" in Source: 00000000-00007644.00000002.239966.52350000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00007644.00000002.239966.D8110000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00007644.00000002.239966.D8246000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00007644.00000002.239966.D8246000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007644.00000002.239966.D8246000.00000002.mdmp ":\users\classic .net apppool\appdata\local\bravesoftware\brave-browser\user data" in Source: 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp ":\program files (x86)\bravesoftware\brave-browser\application\user data" in Source: 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp "??\C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\User Data" in Source: 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp "\hapubws\appdata\local\bravesoftware\brave-browser\user data" in Source: 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp ":\Program Files\BraveSoftware\Brave-Browser\Application\User Data" in Source: 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp49:T769,"\" (Indicator: \"SHA512\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp, 00000000-00005664.00000000.236477.A5681000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007644.00000000.236123.D8110000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007644.00000002.239966.D8110000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007644.00000002.239966.D9C40000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005664.00000000.236477.5B160000.00000020.mdmp, 00000000-00005664.00000000.236477.5D850000.00000040.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.06153","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$33","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$34","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"youtube.com\" (Indicator: \"youtube.com\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004164.00000002.240019.34928000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp\")\n Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"BIOSVersion\" (Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp\")\n Found string \"OSVersionInformation\" (Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp\")\n Found string \"::GetUserNameW\" (Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp, 00000000-00005664.00000000.236477.A5681000.00000002.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004164.00000002.240019.34928000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp\")\n Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004164.00000002.240019.34928000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp, 00000000-00005664.00000000.236477.A5681000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp, 00000000-00005664.00000000.236477.A5681000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History\" (Source: \"00000000-00007644-00000C2D-65698145460\")\n Found string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History\" (Source: \"00000000-00007644-00000C2D-65731816926\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp, 00000000-00005664.00000000.236477.A5681000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp, 00000000-00005664.00000000.236477.A5681000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"FILE_START:%s/%s/Cookies.txt\" (Indicator: \"/cookies\"; Source: \"00000000-00005664.00000000.236477.5B160000.00000020.mdmp, 00000000-00005664.00000000.236477.5D850000.00000040.mdmp\")\n Found string \"FILE_START:%s/%s/Cookies.txt\" (Indicator: \"/cookies\"; Source: \"00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetGeoInfoW\" (Indicator: \"getgeoinfo\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00005664.00000000.236477.35DCF000.00000002.mdmp\")\n Found reference to API \"GetGeoInfoW\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"=' | Out-File requirements.txt\" (Indicator: \"Get-Content\"; Source: \"00000000-00007644.00000002.239966.51820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004164.00000002.240019.34928000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Outlook\\%LOCALAPPDATA%\\Microsoft\\Outlook\" (Indicator: \"\\appdata\\local\\microsoft\\outlook\"; Source: \"00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp, 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp, 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"SELECT origin_url, action_url, username_value, password_value, date_created, date_last_used FROM logins;\" (Indicator: \"password\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found string \"passwords\" (Indicator: \"password\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found string \"SELECT origin_url, username_value, password_value FROM logins;\" (Indicator: \"password\"; Source: \"00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp\")\n Found string \"passwords +%d rows=%d fail=%d\" (Indicator: \"password\"; Source: \"00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Outlook\\%LOCALAPPDATA%\\Microsoft\\Outlook\" in Source: 00000000-00007644.00000001.238045.4F8F0000.00000004.mdmp\n 00000000-00007644.00000002.239966.4F8F0000.00000004.mdmp\n 00000000-00007644.00000003.245480.4F8F0000.00000004.mdmp\n \"%APPDATA%\\Thunderbird\\Profiles\\*\" in Source: 00000000-00007644.00000002.239966.51820000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\n \"SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"=' | Out-File requirements.txt\" (Indicator: \"Out-File\"; Source: \"00000000-00007644.00000002.239966.51820000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004164.00000002.240019.34928000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004164.00000002.240019.34928000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007644.00000000.236123.D8110000.00000004.mdmp, 00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp, 00000000-00007644.00000002.239966.D8110000.00000004.mdmp, 00000000-00007644.00000002.239966.D8246000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007644.00000000.236123.D9C3A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Adobe.dll\" - Location: [%APPDATA%\\Adobe\\Adobe.dll]- [targetUID: 00000000-00007644]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"C:\\Windows\\System32\\RuntimeBroker.exe -Embedding\" (Indicator: \"runtimebroker.exe\")\n \":\\Windows\\System32\\RuntimeBroker.exe -Embedding\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\" has section name .data with entropy \"7.316821689926296\"\n \"8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679.bin\" has section name .rdata with entropy \"7.626616866392316\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/26 Antivirus vendors marked sample as malicious (30% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 27709-19793-000000014012F1B2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Adobe.dll\" has type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 10 sections\"- Location: [%APPDATA%\\Adobe\\Adobe.dll]- [targetUID: 00000000-00007644]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69e016c7bf5c72d80a0dad12"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"