24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T428,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 9112411adfcf… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample 9112411adfcf…. Threat score 35/100. 0/25 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9112411adfcff35164792d11994db048e9472c52c1def67f1e10bb5fbe42f0e6","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","9112411adfcff35164792d11994db048e9472c52c1def67f1e10bb5fbe42f0e6"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"9112411adfcff35164792d11994db048e9472c52c1def67f1e10bb5fbe42f0e6","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":2,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T55a,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "file") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "file") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "file") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp, 00000000-00006308.00000000.153421.BB150000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp, 00000000-00006308.00000000.153421.BB150000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp")26:T4cad,Assembly shows XOR instruction xor rax rsp in Stream UID: 19670-480-0000000140017860 Assembly shows XOR instruction xor eax esp in Stream UID: 19670-480-0000000140017860 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19670-480-0000000140017860 Assembly shows XOR instruction xor ecx esp in Stream UID: 19670-480-0000000140017860 Assembly shows XOR instruction xor cl 01h in Stream UID: 19670-564-000000014000142A Assembly shows XOR instruction xor ecx edx in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor qword ptr [00000001400B9F60h] rsi in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor dword ptr [00000001400B9F60h] esi in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor qword ptr [00000001400B9EF0h] rsi in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor dword ptr [00000001400B9EF0h] esi in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor cl bl in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor qword ptr [00000001400B9F38h] r11 in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor dword ptr [00000001400B9F38h] ebx in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor qword ptr [00000001400B9EF0h] rax in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor dword ptr [00000001400B9EF0h] eax in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor qword ptr [00000001400B9F60h] rax in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor dword ptr [00000001400B9F60h] eax in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor qword ptr [00000001400B9F70h] r11 in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor dword ptr [00000001400B9F70h] ebx in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor qword ptr [00000001400B9EF0h] r11 in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor dword ptr [00000001400B9EF0h] ebx in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor qword ptr [00000001400B9F70h] rax in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor dword ptr [00000001400B9F70h] eax in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor r10d FA70B01Ah in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor edx FA70B01Ah in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor edx eax in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor eax edx in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor r14 r10 in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor esi edx in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor r9d edx in Stream UID: 19670-582-0000000140003080 Assembly shows XOR instruction xor r12 rbp in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor esp ebp in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor qword ptr [00000001400B9F70h] rax in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor dword ptr [00000001400B9F70h] eax in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor ecx esi in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor r9 r8 in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor ecx eax in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor qword ptr [00000001400B9F38h] rax in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor dword ptr [00000001400B9F38h] eax in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor qword ptr [00000001400B9F60h] rax in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor dword ptr [00000001400B9F60h] eax in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor dl C9h in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor ebx ecx in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor r10d ebp in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor edx ebp in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor r11L dl in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor bl dl in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor qword ptr [00000001400B9F38h] rsi in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor dword ptr [00000001400B9F38h] esi in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor byte ptr [rbx] dh in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor r10d edx in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor rbp r9 in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor ebp ecx in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor qword ptr [00000001400B9EF0h] rsi in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor dword ptr [00000001400B9EF0h] esi in Stream UID: 19670-593-0000000140004198 Assembly shows XOR instruction xor r11L cl in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor bl cl in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor qword ptr [00000001400B9F60h] rsi in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor dword ptr [00000001400B9F60h] esi in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor ecx 00007D18h in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor r11d ecx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor ebx ecx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor rcx rdx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor ecx edx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor r11 rdx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor ebx edx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor qword ptr [00000001400B9F60h] r10 in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor dword ptr [00000001400B9F60h] edx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor qword ptr [00000001400B9EF0h] r10 in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor dword ptr [00000001400B9EF0h] edx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor qword ptr [00000001400B9F70h] r10 in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor dword ptr [00000001400B9F70h] edx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor rsi rbx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor esi ebx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor esp edi in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor rsi rcx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor esi ecx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor rsi rdx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor esi edx in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor qword ptr [00000001400B9F38h] rax in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor dword ptr [00000001400B9F38h] eax in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor qword ptr [00000001400B9F60h] rax in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor dword ptr [00000001400B9F60h] eax in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor r11L r9L in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor qword ptr [00000001400B9F00h] rsi in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor dword ptr [00000001400B9F00h] esi in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor qword ptr [00000001400B9F00h] rax in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor dword ptr [00000001400B9F00h] eax in Stream UID: 19670-618-00000001400059D2 Assembly shows XOR instruction xor qword ptr [00000001400B9F70h] r9 in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor dword ptr [00000001400B9F70h] ecx in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor r9L dl in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor cl dl in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor r13d r10d in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor ebp edx in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor r11L r12L in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor bl ah in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor bpl r15L in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor ch bh in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor rcx r12 in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor ecx esp in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor rcx r14 in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor ecx esi in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor qword ptr [00000001400B9F70h] rsi in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor dword ptr [00000001400B9F70h] esi in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor r13 r9 in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor ebp ecx in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor rcx r13 in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor ecx ebp in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor r11d r10d in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor ebx edx in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor r10d r11d in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor edx ebx in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor ecx r12d in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor r8L cl in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor al cl in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor qword ptr [00000001400B9F00h] r9 in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor dword ptr [00000001400B9F00h] ecx in Stream UID: 19670-625-0000000140006289 Assembly shows XOR instruction xor edx eax in Stream UID: 19670-633-0000000140006FD6 Assembly shows XOR instruction xor r8d eax in Stream UID: 19670-633-0000000140006FD6 Assembly shows XOR instruction xor r8L al in Stream UID: 19670-633-0000000140006FD6 Assembly shows XOR instruction xor bl r10L in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor bl dl in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor qword ptr [00000001400B9F00h] r10 in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor dword ptr [00000001400B9F00h] edx in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor qword ptr [00000001400B9EF0h] rax in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor dword ptr [00000001400B9EF0h] eax in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor r10L 82h in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor dl 82h in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor dl r11L in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor dl bl in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor qword ptr [00000001400B9F38h] r14 in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor dword ptr [00000001400B9F38h] esi in Stream UID: 19670-641-000000014000A63F Assembly shows XOR instruction xor eax 0D48FA5Eh in Stream UID: 19670-644-00000001400071DA Assembly shows XOR instruction xor qword ptr [00000001400B9F38h] r9 in Stream UID: 19670-647-0000000140007662 Assembly shows XOR instruction xor dword ptr [00000001400B9F38h] ecx in Stream UID: 19670-647-0000000140007662 Assembly shows XOR instruction xor qword ptr [00000001400B9F60h] r9 in Stream UID: 19670-647-0000000140007662 Assembly shows XOR instruction xor dword ptr [00000001400B9F60h] ecx in Stream UID: 19670-647-0000000140007662 Assembly shows XOR instruction xor qword ptr [00000001400B9F38h] r10 in Stream UID: 19670-681-000000014000A720 Assembly shows XOR instruction xor dword ptr [00000001400B9F38h] edx in Stream UID: 19670-681-000000014000A720 Assembly shows XOR instruction xor qword ptr [00000001400B9F00h] r10 in Stream UID: 19670-681-000000014000A720 Assembly shows XOR instruction xor dword ptr [00000001400B9F00h] edx in Stream UID: 19670-681-000000014000A720 Assembly shows XOR instruction xor r11d edx in Stream UID: 19670-687-000000014000ACB7 Assembly shows XOR instruction xor ebx edx in Stream UID: 19670-687-000000014000ACB7 Assembly shows XOR instruction xor r11d DE006CE4h in Stream UID: 19670-687-000000014000ACB7 Assembly shows XOR instruction xor ebx DE006CE4h in Stream UID: 19670-687-000000014000ACB7 Assembly shows XOR instruction xor qword ptr [00000001400B9F38h] rbx in Stream UID: 19670-695-000000014000AE33 Assembly shows XOR instruction xor dword ptr [00000001400B9F38h] ebx in Stream UID: 19670-695-000000014000AE33 Assembly shows XOR instruction xor qword ptr [00000001400B9F38h] rdx in Stream UID: 19670-695-000000014000AE33 Assembly shows XOR instruction xor dword ptr [00000001400B9F38h] edx in Stream UID: 19670-695-000000014000AE33 Assembly shows XOR instruction xor dl r9L in Stream UID: 19670-695-000000014000AE33 Assembly shows XOR instruction xor dl cl in Stream UID: 19670-695-000000014000AE33 Assembly shows XOR instruction xor ecx edx in Stream UID: 19670-696-000000014000AE6A Assembly shows XOR instruction xor r15d 5A512086h in Stream UID: 19670-696-000000014000AE6A Assembly shows XOR instruction xor edi 5A512086h in Stream UID: 19670-696-000000014000AE6A Assembly shows XOR instruction xor ah byte ptr [rbp+3Fh] in Stream UID: 19670-702-000000014000B07A Assembly shows XOR instruction xor cl byte ptr [rdx] in Stream UID: 19670-702-000000014000B07A Assembly shows XOR instruction xor al 2Eh in Stream UID: 19670-702-000000014000B07A Assembly shows XOR instruction xor rcx r11 in Stream UID: 19670-748-000000014000C1C9 Assembly shows XOR instruction xor ecx ebx in Stream UID: 19670-748-000000014000C1C9 Assembly shows XOR instruction xor qword ptr [00000001400B9F60h] rbx in Stream UID: 19670-973-0000000140011D80 Assembly shows XOR instruction xor dword ptr [00000001400B9F60h] ebx in Stream UID: 19670-973-0000000140011D80 Assembly shows XOR instruction xor qword ptr [00000001400B9F70h] r9 in Stream UID: 19670-973-0000000140011D80 Assembly shows XOR instruction xor dword ptr [00000001400B9F70h] ecx in Stream UID: 19670-973-0000000140011D80 Assembly shows XOR instruction xor qword ptr [00000001400B9EF0h] r9 in Stream UID: 19670-973-0000000140011D80 Assembly shows XOR instruction xor dword ptr [00000001400B9EF0h] ecx in Stream UID: 19670-973-0000000140011D80 Assembly shows XOR instruction xor qword ptr [00000001400B9F38h] r9 in Stream UID: 19670-973-0000000140011D80 Assembly shows XOR instruction xor dword ptr [00000001400B9F38h] ecx in Stream UID: 19670-973-0000000140011D80 Assembly shows XOR instruction xor rax rsp in Stream UID: 19670-1048-0000000140019006 Assembly shows XOR instruction xor eax esp in Stream UID: 19670-1048-0000000140019006 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19670-1048-0000000140019006 Assembly shows XOR instruction xor ecx esp in Stream UID: 19670-1048-0000000140019006 Assembly shows XOR instruction xor rax rsp in Stream UID: 19670-1056-0000000140019387 Assembly shows XOR instruction xor eax esp in Stream UID: 19670-1056-0000000140019387 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19670-1056-0000000140019387 Assembly shows XOR instruction xor ecx esp in Stream UID: 19670-1056-0000000140019387 Assembly shows XOR instruction xor qword ptr [00000001400B9F38h] r10 in Stream UID: 19670-2305-00000001400028CC Assembly shows XOR instruction xor dword ptr [00000001400B9F38h] edx in Stream UID: 19670-2305-00000001400028CC Assembly shows XOR instruction xor qword ptr [00000001400B9F70h] rax in Stream UID: 19670-2305-00000001400028CC Assembly shows XOR instruction xor dword ptr [00000001400B9F70h] eax in Stream UID: 19670-2305-00000001400028CC Assembly shows XOR instruction xor qword ptr [00000001400B9EF0h] r10 in Stream UID: 19670-2305-00000001400028CC Assembly shows XOR instruction xor dword ptr [00000001400B9EF0h] edx in Stream UID: 19670-2305-00000001400028CC Assembly shows XOR instruction xor qword ptr [00000001400B9F70h] rsi in Stream UID: 19670-2305-00000001400028CC Assembly shows XOR instruction xor dword ptr [00000001400B9F70h] esi in Stream UID: 19670-2305-00000001400028CC Assembly shows XOR instruction xor qword ptr [rsp+20h] rax in Stream UID: 19670-2310-0000000140012B5A Assembly shows XOR instruction xor dword ptr [rsp+20h] eax in Stream UID: 19670-2310-0000000140012B5A Assembly shows XOR instruction xor rcx rax in Stream UID: 19670-2310-0000000140012B5A Assembly shows XOR instruction xor ecx eax in Stream UID: 19670-2310-0000000140012B5A Assembly shows XOR instruction xor rcx qword ptr [rsp+20h] in Stream UID: 19670-2310-0000000140012B5A Assembly shows XOR instruction xor ecx dword ptr [rsp+20h] in Stream UID: 19670-2310-0000000140012B5A Assembly shows XOR instruction xor qword ptr [00000001400B9F60h] r9 in Stream UID: 19670-2326-000000014000673D Assembly shows XOR instruction xor dword ptr [00000001400B9F60h] ecx in Stream UID: 19670-2326-000000014000673D Assembly shows XOR instruction xor qword ptr [00000001400B9F70h] r9 in Stream UID: 19670-2326-000000014000673D Assembly shows XOR instruction xor dword ptr [00000001400B9F70h] ecx in Stream UID: 19670-2326-000000014000673D Assembly shows XOR instruction xor qword ptr [00000001400B9EF0h] r9 in Stream UID: 19670-2334-0000000140011C4D Assembly shows XOR instruction xor dword ptr [00000001400B9EF0h] ecx in Stream UID: 19670-2334-0000000140011C4D Assembly shows XOR instruction xor qword ptr [00000001400B9F70h] r9 in Stream UID: 19670-2334-0000000140011C4D Assembly shows XOR instruction xor dword ptr [00000001400B9F70h] ecx in Stream UID: 19670-2334-0000000140011C4D27:T4e6,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000051a705a3fa7f00000000000000000000000000000000000040ee754a56000000000000000000000090ed754a56000000103313a3fa7f00000000000000000000903213a3fa7f00000400000000000000000000002402000000000000240200003c0000000200000010d115bb2402000008ee754a560000002100220056000000b2af7880fa7f0000000000000000000010016f80fa7f000040000000000000000000000000000000801116bb24020000e07415bb24020000c9ee754a560000001ba005a3fa7f0000e07415bb24020000801215bb240200000000000000000000c3f002a3fa7f0000da014eac00000000e88403a3fa7f0000f87415bb (UID: 00000000-00006308) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006308)28:T5c2,GetProcessHeap@kernel32.dll at 19670-564-000000014000142A GetProcessHeap@kernel32.dll at 19670-565-0000000140003EF4 GetProcessHeap@kernel32.dll at 19670-582-0000000140003080 GetProcessHeap@kernel32.dll at 19670-605-0000000140005030 GetProcessHeaps@kernel32.dll at 19670-618-00000001400059D2 GetProcessHeap@kernel32.dll at 19670-625-0000000140006289 GetProcessHeap@kernel32.dll at 19670-630-0000000140006808 GetProcessHeap@kernel32.dll at 19670-633-0000000140006FD6 GetProcessHeap@kernel32.dll at 19670-641-000000014000A63F GetProcessHeap@kernel32.dll at 19670-644-00000001400071DA GetProcessHeap@kernel32.dll at 19670-647-0000000140007662 GetProcessHeap@kernel32.dll at 19670-651-0000000140007B8B GetProcessHeap@kernel32.dll at 19670-655-000000014000833D GetProcessHeap@kernel32.dll at 19670-657-00000001400084CF GetProcessHeap@kernel32.dll at 19670-668-0000000140009C1F GetProcessHeap@kernel32.dll at 19670-680-000000014000A542 GetProcessHeap@kernel32.dll at 19670-687-000000014000ACB7 GetProcessHeap@kernel32.dll at 19670-688-000000014000AD40 GetProcessHeap@kernel32.dll at 19670-695-000000014000AE33 GetProcessHeap@kernel32.dll at 19670-696-000000014000AE6A GetProcessHeap@kernel32.dll at 19670-702-000000014000B07A GetProcessHeap@kernel32.dll at 19670-708-000000014000B23A GetProcessHeap@kernel32.dll at 19670-735-000000014000BBC8 GetProcessHeap@kernel32.dll at 19670-748-000000014000C1C9 GetProcessHeap@kernel32.dll at 19670-819-000000014000D31329:T3544,"file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetProcessId (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetShellWindow (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FindFirstFileExW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetActiveProcessorCount (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetActiveProcessorGroupCount (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetMaximumProcessorCount (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetThreadId (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter InterlockedFlushSList (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter IsThreadAFiber (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter RtlCaptureContext (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter RtlLookupFunctionEntry (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter RtlPcToFileHeader (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter RtlUnwindEx (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter DrawTextW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetDoubleClickTime (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetInputState (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter GetMessagePos (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter Rectangle (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter TextOutW (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter NtReadFile (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter NtWriteFile (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter RtlAcquireSRWLockExclusive (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter FindWindowA (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter RtlEnterCriticalSection (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter RtlLeaveCriticalSection (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00006308) "file.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006308)2a:T817,"zwyz.)g:alN)%a6v'?3zlGL;uyGw:9lZ2{gG2_Oz:d6l6,;x(?[Fa)T)MIOY5d63E8IM.dQq;.gC&(y{duwU{uuz&dGAzTGAzqDlM_lb[9G..Xq0u5wyz%g.z$gTzT6,l?qXE$uGfbvaf6:aQOPu(Zz?A}}u(d{3%I:Y|NYu:4::$2z:)((_ubp?q4E,%'.Pdb;d{pzN4Q50TCN%G5zl9h_LhNV{q{gG0qg8&aN4y28zDzUaablaw)N%TAzTf(9_wyRT$9RMD,g36DR)D'A:qN|Tg;)?aAlO$qlu?2p:$qa}A45::5R4%6V:h(z$:5xuA8Ruqz(?w:{}I;5::)z:Vyuuugu91bLqD)O}_)u2GbVN%L:FwM::)F$pFf:u)N>UOz&(qNEb3AuCll&N%<$u6fEwd2::$UOPgC).lL:}hQ5::5z5y3):wyuuu)&4CN4VMD8g6yuN%0b:6w::)V?Tz$N916[OT9N%DzD{Ag>CV5z{q,&?A4ebVAlO$(ld62ERwO;%N4C}0X.CBL'3lb:}gTE)gbM%>bADZUNugG_}Fuw|aNB)u$2f).3:3u5Ny>b:|$b}a6v'?3zlGL;uyGw:9lZ2{gG2_Oz:d6l6,;x(?[Fa)T)MIOY5d63E8IM.dQq;.gC&(y{duwU{uuz&dGAzTGAzqDlM_lb[9G..Xq0u5wyz%g.z$gTzT6,l?qXE$uGfbvaf6:aQOPu(Zz?A}}u(d{3%I:Y|NYu:4::$2z:)((_ubp?q4E,%'.Pdb;d{pzN4Q50TCN%G5zl9h_LhNV{q{gG0qg8&aN4y28zDzUaablaw)N%TAzTf(9_wyRT$9RMD,g36DR)D'A:qN|Tg;)?aAlO$qlu?2p:$qa}A45::5R4%6V:h(z$:5xuA8Ruqz(?w:{}I;5::)z:Vyuuugu91bLqD)O}_)u2GbVN%L:FwM::)F$pFf:u)N>UOz&(qNEb3AuCll&N%<$u6fEwd2::$UOPgC).lL:}hQ5::5z5y3):wyuuu)&4CN4VMD8g6yuN%0b:6w::)V?Tz$N916[OT9N%DzD{Ag>CV5z{q,&?A4ebVAlO$(ld62ERwO;%N4C}0X.CBL'3lb:}gTE)gbM%>bADZUNugG_}Fuw|aNB)u$2f).3:3u5Ny>b:|$b}?nf:.uau:nzw$2(ybd'if.pdv:gg?xat8ldcg&[>(6)8zl?$6%ruz6rubo<55vp$z1pblb;wbl}n%.ixd.)u5l?:w6}u5bdr$6zq(q.du&|<85?av_}2v?|:y;|f.6;6::>65l?tiq2.lu?4:l%g{x29q$u.n:9n619x6x(ybg}ue(ar&>qvg_(yb,}(gxta.00(ultd)n%n5u23(am3x:duel$ydpauuu:tue|gg3;$.;::el?3mg(tlu)36r}bmx..d,&>g:?t$r2.lu}p_mux?rnpv.w%>xbzw{ur)?uhuug(;(;<5(?5;u[q.nuun:ug[x9ozxgu6:{lzgrn8rg06:clzgrgzrguv|{<8guy{4pa113aq:alvp_36:_{2:w{_%aq1z_lg:a{_t?5cn}.x0a{fuu&l.u_muuug:.)dnag{n%9$uaggmt)g.l|n}a>68x[paa(cn%921u3p:.&$f36:}p3.dw[dtv::3ld.a2l:216l:$|xl{3:ag'xi$zr?mcx3a6dv:3rau(mlul99lvvzl.q_ga;ygg3:fpl.:%zn%9..v5l8w168<>uu6yuaqta{auu.::4{mqvaa)gm65;x$[xqt8(?w5frnzr.[qlu6)n)t8vud8_tw:::%,uglzgr65%?ua>l<8ztwb::yaug({euuao)$?xzw18azm.z6prutal?tmtda&:u_5l?ua>bg.4:q&$2u?n1gn$t6ya}),l?tlacmx." [Source: file] Observed email domain:")u.4|b_9q${[?t<8%fgbptnwul3z%f(a9nvf:ml'9nvfanzl:;vwa{al.y6%:>?nf:.uau:nzw$2(ybd'if.pdv:gg?xat8ldcg&[>(6)8zl?$6%ruz6rubo<55vp$z1pblb;wbl}n%.ixd.)u5l?:w6}u5bdr$6zq(q.du&|<85?av_}2v?|:y;|f.6;6::>65l?tiq2.lu?4:l%g{x29q$u.n:9n619x6x(ybg}ue(ar&>qvg_(yb,}(gxta.00(ultd)n%n5u23(am3x:duel$ydpauuu:tue|gg3;$.;::el?3mg(tlu)36r}bmx..d,&>g:?t$r2.lu}p_mux?rnpv.w%>xbzw{ur)?uhuug(;(;<5(?5;u[q.nuun:ug[x9ozxgu6:{lzgrn8rg06:clzgrgzrguv|{<8guy{4pa113aq:alvp_36:_{2:w{_%aq1z_lg:a{_t?5cn}.x0a{fuu&l.u_muuug:.)dnag{n%9$uaggmt)g.l|n}a>68x[paa(cn%921u3p:.&$f36:}p3.dw[dtv::3ld.a2l:216l:$|xl{3:ag'xi$zr?mcx3a6dv:3rau(mlul99lvvzl.q_ga;ygg3:fpl.:%zn%9..v5l8w168<>uu6yuaqta{auu.::4{mqvaa)gm65;x$[xqt8(?w5frnzr.[qlu6)n)t8vud8_tw:::%,uglzgr65%?ua>l<8ztwb::yaug({euuao)$?xzw18azm.z6prutal?tmtda&:u_5l?ua>bg.4:q&$2u?n1gn$t6ya}),l?tlacmx" [Source: file]2f:T489,Heuristic match: "v6w::)>{%::4:;29}_9ul1$xm%m).le|}6xqz6qu}u31%6ifrb82.0cg.0bu4}{zug|r5yu68x'uo%2l:5l:3qzh>yzrb%z,8wwqn%_mt&i1)w:::$>z4u?x3{3:bg?x0{_d31b:}g[r)f?{5uc:u(nebtluu<'ed:cul't>1{ug(g;:uwve%):::$26d{ind%b}&q2gz6yu}ly;uuzli(2r.im:3{a%9ldfrrzv" Heuristic match: "?$1l?.ligt6:u{g15d(t[nn:[ga6,f8>(c'cyg2d58z5vy0aqu2;t.:u2d{xuu68u:)::4:}oeloy6tlxx:fu&(uqp(?p_'uigexc&xpub6v'gr0$(_buu_$dn.?$a>:mzg?.vr(a(u:$2[[uu6,,z&" Pattern match: "http://schemas.microsoft.com/smi/200" Heuristic match: ":$)x&gzr;:?|}xq.8l?$wllggz'liudzgotx:ex$ud.m5tuu:oz(neg|u,%?4.xf'4ubue8>aat_}hv3v8c'ud31d6.(uuu4f6.6zx?|gt9wwa:$>8tg$pta)ge[2.v?w.%uu<8qu6m%3l.(h89d$($65l?m>a9d$u" Heuristic match: "a16:)6y689f3uunb}316bypub:y0mwy1zunefz1uux)%llax?aqee:q:::5z.(3r}qbvx{n;[ln0fg[r[6albq?4tn[n%u::93bx3u52tugvn$61uuae[u)n:)1}uuneevm:zv:u%i3}cuu'x.}q:y6y0"30:T63c,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "file") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp, 00000000-00006308.00000000.153421.BB150000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp, 00000000-00006308.00000000.153421.BB150000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp, 00000000-00006308.00000000.153421.BB150000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp")31:T5ce,Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "file") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "file") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "file") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "file") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "file") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006308.00000000.153421.23652000.00000002.mdmp")32:T558,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADx0lEQVR4XrXWV09UQRQH8Pk8VizoAktdFpbeuwUVu2JDpWiihgdiRBNCLDyoIRpMxARf6CiLSy9SDBLUSBRDwkfg5Thn7p29Z2/ZvZCwyXnd+SXz/98zjPFfesYQpKd5ISPVC5meQchMGoSsxM+Q7foEOfF8YgcgN2YA8pz9kBfZB/kRfVBwuBcKw/kc7IGi/d1QHMZnbxeU7O6C0p2dULbD3rDUnC+QlsUHEek6hFtBZCMijiCiNETBIYnogeJ9gYhSkwP1w1LyfGCGyEBEskTwSdAQudGI6FcQjkBEEUXsCo1gnoJhkIhURGQiYkhBpGgIcSUSgVciEXgljj4NcUAiuqFkD4eEQDBP4TAEILIJAnOR4lUQSQQhc2GGCO+BQokIIwiLXLDk4hFILiKIXJ+GkOFEhIcgaDgR4SQIGU5EyHAiwiKcLKl0FJJLCCLfBykqYrsaQq+EuY+MQlIZH4EYAbwSP8IknLQhOYkcQMK5lYawxGNj4D5KEMUKwoMI2hCRi8CG+LxrMMzHVkP84QxsCHOVj0PicYIoJYggDentXoWNjQ0xfV2rW24Ic50cB9cJieCDVyIRNJykIR0df/yHy/nYvmJsCA2nRUNYQsUEJJwiCLwSgRgVCH1D3r77bThcTlvrL9OGiHBaNITFn5mEhNOImFAQ5WMgciERpCEtr38aDtXPy+fLm2oIizs3CfFn+Vgh1HA+efHDcJjVND9etNghajhJQ1jshSmIOz8ViMBcYDjVhtQ3LRkOCTUP6xds7RAWc2kaDIgKDVHzaNHw53bnfu1syB3CYiqnQSAuKog4RGAuVER143fDH9ude3Vz1jtEbQiLvjoD0ZUzEHOZIDAXKgIb8uDpsuHPQ01DwzdbO4Q5r38FgbiiIcSVSISai8ZXoRsgp6l5SVtkJg8c2hAWVTULiHBeIwiZC11DnrVZfwPktHBoqB1CG8Iib82CQNwgiEqC0DWk1eQrKOfN+xVbO4S+slhE9RwIxE2JUK7EH049gueiveef4fAPnX9t7RD9K4tF1M6DQNxWEFGIUHMRrCGdQ2v+w7sG12ztEET4HzjqK4s57syDAxE1iJgzIII1ZHByHbwT67Z2iNUriznuLoBA1GmISERUEYS/ISScHOE6w78V+L3Qf7438cpSAGYIGU6bDcGPltkOCfXK0gByJEKG06QhpuE02SF2XllGgETIcAZriJoLsx0iX1nuYK8svBLD4eRKttqQzbyyrAEqwtAQGs4gDbF8ZdFwckRwgERsoSF2X1kCwJshxnA4nW1qyH+exjlb2xRFgwAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9112411adfcff35164792d11994db048e9472c52c1def67f1e10bb5fbe42f0e6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1790726580218,"unified_at":"2026-09-30T00:03:00.218Z","metadata":{"hashes":{"sha256":"9112411adfcff35164792d11994db048e9472c52c1def67f1e10bb5fbe42f0e6","sha1":"de49e9f8f1b020d62483d4f483ac8342cbcd6e8e","md5":"532eff5d61b1e998d1062b7dc344f41f","sha512":"41b3a15a567fa7a247e1f8cd6387080950870c36a48d128dd8625671b1af2bd6baf64d99d9fe71d1f6db178d00b60e80c1186b87abb7331d7edc1abf7a213bfa","ssdeep":"12288:pZVOOr4kZ74g4ydiClowkejC4UQx+4QRix3Q/K+aXGiS2B2UZ16zusTB:piOCQiYowkRXQx+7WqK+qS42UZAzu+","ssdeep_chunks":["12288:pZVOOr4","12288:ZVOOr4k","12288:VOOr4kZ","12288:OOr4kZ7","12288:Or4kZ74","12288:r4kZ74g","12288:4kZ74g4","12288:kZ74g4y","12288:Z74g4yd","12288:74g4ydi","12288:4g4ydiC","12288:g4ydiCl","12288:4ydiClo","12288:ydiClow","12288:diClowk","12288:iClowke","12288:Clowkej","12288:lowkejC","12288:owkejC4","12288:wkejC4U","12288:kejC4UQ","12288:ejC4UQx","12288:jC4UQx+","12288:C4UQx+4","12288:4UQx+4Q","12288:UQx+4QR","12288:Qx+4QRi","12288:x+4QRix","12288:+4QRix3","12288:4QRix3Q","12288:QRix3Q/","12288:Rix3Q/K","12288:ix3Q/K+","12288:x3Q/K+a","12288:3Q/K+aX","12288:Q/K+aXG","12288:/K+aXGi","12288:K+aXGiS","12288:+aXGiS2","12288:aXGiS2B","12288:XGiS2B2","12288:GiS2B2U","12288:iS2B2UZ","12288:S2B2UZ1","12288:2B2UZ16","12288:B2UZ16z","12288:2UZ16zu","12288:UZ16zus","12288:Z16zusT","12288:16zusTB","24576:pZVOOr4","24576:ZVOOr4k","24576:VOOr4kZ","24576:OOr4kZ7","24576:Or4kZ74","24576:r4kZ74g","24576:4kZ74g4","24576:kZ74g4y","24576:Z74g4yd","24576:74g4ydi","24576:4g4ydiC","24576:g4ydiCl","24576:4ydiClo","24576:ydiClow","24576:diClowk","24576:iClowke","24576:Clowkej","24576:lowkejC","24576:owkejC4","24576:wkejC4U","24576:kejC4UQ","24576:ejC4UQx","24576:jC4UQx+","24576:C4UQx+4","24576:4UQx+4Q","24576:UQx+4QR","24576:Qx+4QRi","24576:x+4QRix","24576:+4QRix3","24576:4QRix3Q","24576:QRix3Q/","24576:Rix3Q/K","24576:ix3Q/K+","24576:x3Q/K+a","24576:3Q/K+aX","24576:Q/K+aXG","24576:/K+aXGi","24576:K+aXGiS","24576:+aXGiS2","24576:aXGiS2B","24576:XGiS2B2","24576:GiS2B2U","24576:iS2B2UZ","24576:S2B2UZ1","24576:2B2UZ16","24576:B2UZ16z","24576:2UZ16zu","24576:UZ16zus","24576:Z16zusT","24576:16zusTB","12288:piOCQiY","12288:iOCQiYo","12288:OCQiYow","12288:CQiYowk","12288:QiYowkR","12288:iYowkRX","12288:YowkRXQ","12288:owkRXQx","12288:wkRXQx+","12288:kRXQx+7","12288:RXQx+7W","12288:XQx+7Wq","12288:Qx+7WqK","12288:x+7WqK+","12288:+7WqK+q","12288:7WqK+qS","12288:WqK+qS4","12288:qK+qS42","12288:K+qS42U","12288:+qS42UZ","12288:qS42UZA","12288:S42UZAz","12288:42UZAzu","12288:2UZAzu+"],"imphash":"b9c8c3510558b30107f59430dc80fb95"},"file_info":{"file_name":"file.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1046016,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790724028000,"last_seen":1790724982000,"last_multi_scan":1790724982000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":39},"sandbox_signatures":{"informative_count":99,"suspicious_count":7,"malicious_count":2,"total":108},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains native function calls"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Calls an API typically used to create a thread in another process"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"file\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"file\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"file\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp, 00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"file\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"RC2\"; File: \"file\")\n file/memory contains long string with (Indicator: \"RC2\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"file\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@kernel32.dll at 19670-537-0000000140012820","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 763923; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; File: \"file\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"file\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"file\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"file\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"file\"\n Found system information discovery API: \"GetNativeSystemInfo\" in file \"file\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"file\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"file\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"00000000-00006308-00000C2C-1395149440\")\n Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"file.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006308)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"file.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006308)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"file.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006308)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006308)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@kernel32.dll at 19670-593-0000000140004198\n GetTickCount64@kernel32.dll at 19670-695-000000014000AE33","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@kernel32.dll at 19670-1048-0000000140019006","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDriveStringsW@kernel32.dll at 19670-618-00000001400059D2\n GetLogicalDriveStringsW@kernel32.dll at 19670-681-000000014000A720\n GetLogicalDriveStringsW@kernel32.dll at 19670-973-0000000140011D80\n GetDriveTypeW@kernel32.dll at 19670-2326-000000014000673D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@kernel32.dll at 19670-593-0000000140004198\n GetSystemTimeAsFileTime@kernel32.dll at 19670-695-000000014000AE33\n GetSystemTimeAsFileTime@kernel32.dll at 19670-2310-0000000140012B5A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@kernel32.dll at 19670-593-0000000140004198\n GetSystemTimeAsFileTime@kernel32.dll at 19670-695-000000014000AE33\n GetSystemTimeAsFileTime@kernel32.dll at 19670-2310-0000000140012B5A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@kernel32.dll at 19670-593-0000000140004198\n GetVersion@kernel32.dll at 19670-695-000000014000AE33","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"file\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetNativeSystemInfo@kernel32.dll at 19670-695-000000014000AE33","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"file\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetSystemDefaultUILanguage@kernel32.dll at 19670-625-0000000140006289\n GetUserDefaultLangID@kernel32.dll at 19670-2334-0000000140011C4D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"file\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeaps\" (Indicator: \"GetProcessHeaps\"; File: \"file\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"file\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"GetProcessHeaps\" (Indicator: \"GetProcessHeaps\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006308)\n \"file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006308)\n \"file.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006308)\n \"file.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00006308)\n \"file.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00006308)\n \"file.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00006308)\n \"file.exe\" called \"LoadLibrary\" with a parameter gdi32.dll (UID: 00000000-00006308)\n \"file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006308)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"$2a","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"file\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@kernel32.dll at 19670-609-0000000140010BA1\n WaitForSingleObject@kernel32.dll at 19670-616-0000000140005762","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: file)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@kernel32.dll at 19670-582-0000000140003080","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"file\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"file\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")\n Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"file\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"file.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffa806f0000\n \"file.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-2\" at base 7ffaa0130000\n \"file.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffaa0130000\n \"file.exe\" loaded module \"KERNEL32\" at base 7ffaa2290000\n \"file.exe\" loaded module \"KERNEL32.DLL\" at base 7ffaa2290000\n \"file.exe\" loaded module \"USER32.DLL\" at base 7ffaa0560000\n \"file.exe\" loaded module \"NTDLL.DLL\" at base 7ffaa3020000\n \"file.exe\" loaded module \"GDI32.DLL\" at base 7ffaa28b0000\n \"file.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2\" at base 7ffa9f400000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A0470000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A08D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"file\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"file\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file\" has an writable section named \".data\"\n \"file\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"file\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x140012b40,add\trsp, 0x28,jmp\t0x1400129a0,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbx,sub\trsp, 0x30,mov\trax, qword ptr [rip + 0xa6933],movabs\trbx, 0x2b992ddfa232,cmp\trax, rbx,je\t0x140012b6c,not\trax,mov\tqword ptr [rip + 0xa695a], rax,add\trsp, 0x30,pop\trbx,ret\t,lea\trcx, [rsp + 0x40],mov\tqword ptr [rsp + 0x40], 0,call\tqword ptr [rip + 0xa3038],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"file\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"file.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"file\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"file\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp, 00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 6308)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"file.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\file.exe\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"file.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"file.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"file.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\"\n \"file.exe\" trying to touch file \"C:\\MSVCP140.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"file.exe\" touched file \"C:\\Program Files\\DITTO\\PLOUMPIIGOID\"\n \"file.exe\" touched file \"C:\\Program Files\\ALLUVIAL\\LLUSTIOUGS.TXT\"\n \"file.exe\" touched file \"C:\\Program Files\\GRUBS\\AUERKUSLY.DAT\"\n \"file.exe\" touched file \"C:\\Program Files (x86)\\WIRINGS\\TRITYUNKOOH\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"file.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\MSVCP140.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\MSVCP140.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\VCRUNTIME140_1.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\VCRUNTIME140_1.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"file\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: file]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"file\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"file\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"file\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: file]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"file\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"file\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"file\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"file\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"file\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"file\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp, 00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"file\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp, 00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"file\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp, 00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp, 00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\file.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006308.00000000.153421.BB150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"file\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"file\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"file\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"file\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"file\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00006308.00000000.153421.23652000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"LCMapStringEx\" (Source: file, API is part of module: KERNELBASE.DLL)\n Found string \"CompareStringEx\" (Source: file, API is part of module: KERNELBASE.DLL)\n Found string \"AppPolicyGetProcessTerminationMethod\" (Source: file, API is part of module: KERNEL.APPCORE.DLL)\n Found string \"AreFileApisANSI\" (Source: file, API is part of module: KERNELBASE.DLL)\n Found string \"LocaleNameToLCID\" (Source: file, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@kernel32.dll at 19670-582-0000000140003080\n GetModuleHandleW@kernel32.dll at 19670-618-00000001400059D2\n GetModuleHandleW@kernel32.dll at 19670-630-0000000140006808\n GetModuleHandleW@kernel32.dll at 19670-1157-000000014002165A\n GetModuleHandleA@kernel32.dll at 19670-2339-0000000140004EF3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\file.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@kernel32.dll at 19670-582-0000000140003080\n GetCommandLineA@kernel32.dll at 19670-618-00000001400059D2\n GetCommandLineA@kernel32.dll at 19670-2308-0000000140013318","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@kernel32.dll at 19670-1056-0000000140019387","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtWriteFile@ntdll.dll at 19670-609-0000000140010BA1\n NtReadFile@ntdll.dll at 19670-616-0000000140005762","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetTickCount64\n CreateFileW\n FindNextFileW\n GetModuleFileNameW\n GetSystemDirectoryW\n GetTempPathW\n FindFirstFileExW\n TerminateProcess\n GetCommandLineW\n GetProcAddress\n GetModuleHandleW\n GetCommandLineA\n VirtualProtect\n GetModuleHandleExW\n UnhandledExceptionFilter\n GetNativeSystemInfo\n GetFileAttributesW\n GetStartupInfoW\n IsDebuggerPresent\n GetModuleHandleA\n LoadLibraryExW\n WriteFile\n GetLogicalDrives\n GetDriveTypeW\n LoadLibraryA\n GetTickCount","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to create a thread in another process","description":"\"file.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"288\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"110429184\"\n \"lpParameter\": \"0\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"file.exe\" wrote 00090575 bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 288)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":28,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6abc4b76c395eb6ccf00bfa0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"submit_name":"file","analysis_start_time":"2026-09-29T23:36:23+00:00","indicators_count":{"informative":99,"suspicious":12,"malicious":2},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}],"processes":[{"pid":6308,"ppid":0,"name":"file.exe","command_line":"","sha256":"9112411adfcff35164792d11994db048e9472c52c1def67f1e10bb5fbe42f0e6","normalized_path":"C:\\file.exe","uid":"00000000-00006308","icon":"$32"}],"all_imported_dlls":["ole32.dll","oleaut32.dll","gdi32.dll","kernel32.dll","win32u.dll","vcruntime140.dll","bcryptprimitives.dll","advapi32.dll","msvcp_win.dll","combase.dll","sechost.dll","shlwapi.dll","cryptsp.dll","kernel.appcore.dll","gdi32full.dll","ucrtbase.dll","ntdll.dll","KernelBase.dll","VxSSL64.dll","ws2_32.dll","rpcrt4.dll","user32.dll","apphelp.dll","fltLib.dll","msvcp140.dll","vcruntime140_1.dll","imm32.dll","msvcrt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%PROGRAMFILES%\\DITTO\\PLOUMPIIGOID","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"path":"%PROGRAMFILES%\\ALLUVIAL\\LLUSTIOUGS.TXT","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"path":"%PROGRAMFILES%\\GRUBS\\AUERKUSLY.DAT","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]},{"path":"%PROGRAMFILES%\\(x86)\\WIRINGS\\TRITYUNKOOH","sources":[{"report_type":"sandbox","report_id":"6abc4b76c395eb6ccf00bfa0"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6abc4b76c395eb6ccf00bfa0"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Sample 9112411adfcf… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 9112411adfcf…. Threat score 35/100. 0/25 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9112411adfcff35164792d11994db048e9472c52c1def67f1e10bb5fbe42f0e6"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 9112411adfcf… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 9112411adfcf…. Threat score 35/100. 0/25 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9112411adfcff35164792d11994db048e9472c52c1def67f1e10bb5fbe42f0e6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 9112411adfcf… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 9112411adfcf…. Threat score 35/100. 0/25 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]