26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T477,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 91f6fc2ae99e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 91f6fc2ae99e…. Malware family: Malware. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f"],"about":{"@type":"SoftwareApplication","name":"fixxing.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta78,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") ".exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") ".exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") ".exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") ".exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") ".exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") ".exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") ".exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") ".exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") ".exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") ".exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") ".exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") ".exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") ".exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER")28:T737,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" ".exe" touched file "C:\Windows\assembly\pubpol247.dat" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll.aux" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll.aux" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll.aux" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll.aux" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll.aux"29:T492,".exe" queried SystemProcessInformation at 00066488-00004076-00000105-4316707 ".exe" queried SystemProcessInformation at 00066488-00004076-00000105-7979249 ".exe" queried SystemProcessInformation at 00066488-00004076-00000105-7980896 ".exe" queried SystemProcessInformation at 00066488-00004076-00000105-7981698 ".exe" queried SystemProcessInformation at 00066488-00004076-00000105-113575259 ".exe" queried SystemProcessInformation at 00066488-00004076-00000105-113576392 ".exe" queried SystemProcessInformation at 00066488-00004076-00000105-113577444 ".exe" queried SystemProcessInformation at 00066488-00004076-00000105-13045787770351407 ".exe" queried SystemProcessInformation at 00066488-00004076-00000105-13045787770352459 ".exe" queried SystemProcessInformation at 00066488-00004076-00000105-13045787804462612 ".exe" queried SystemProcessInformation at 00066488-00004076-00000105-13045787804464183 ".exe" queried SystemProcessInformation at 00066488-00004076-00000105-130457878044656752a:T8e7,".exe" wrote bytes "b81015b86effe0" to virtual address "0x757B11F8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "0000000000000000" to virtual address "0x042301A0" ".exe" wrote bytes "b88011b86effe0" to virtual address "0x75E01368" (part of module "WS2_32.DLL") ".exe" wrote bytes "95945d01" to virtual address "0x6A08F798" (part of module "CLR.DLL") ".exe" wrote bytes "f8117b75" to virtual address "0x757C8368" (part of module "SSPICLI.DLL") ".exe" wrote bytes "00000000" to virtual address "0x0428B47C" ".exe" wrote bytes "48127b75" to virtual address "0x757C8364" (part of module "SSPICLI.DLL") ".exe" wrote bytes "0000000000000000" to virtual address "0x04230178" ".exe" wrote bytes "f8117b75" to virtual address "0x757C83E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48127b75" to virtual address "0x757C83DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "68130000" to virtual address "0x75E01680" (part of module "WS2_32.DLL") ".exe" wrote bytes "00000000" to virtual address "0x0428B488" ".exe" wrote bytes "00000000" to virtual address "0x0428B48C" ".exe" wrote bytes "c04ea5772054a677e065a677b538a7770000000000d0d27600000000c5ead2760000000088ead27600000000e968b1758228a777ee29a77700000000d269b175000000007dbbd2760000000009beb17500000000ba18d27600000000" to virtual address "0x75E61000" (part of module "NSI.DLL") ".exe" wrote bytes "48120000" to virtual address "0x757B139C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48120000" to virtual address "0x757B12DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "0000000000000000" to virtual address "0x042301C8" ".exe" wrote bytes "000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" to virtual address "0x04230208" ".exe" wrote bytes "f8117b75" to virtual address "0x757C834C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f8110000" to virtual address "0x757B1408" (part of module "SSPICLI.DLL")2b:T4a8,Detected alert "ETPRO MALWARE NanoCore RAT CnC 7" (SID: 2816766, Rev: 2, Severity: 1) categorized as "Malware Command and Control Activity Detected" (PUA/PUP/Adware) Detected alert "ETPRO MALWARE NanoCore RAT Keep-Alive Beacon (Inbound)" (SID: 2841753, Rev: 1, Severity: 1) categorized as "Malware Command and Control Activity Detected" (PUA/PUP/Adware) Detected alert "ETPRO MALWARE NanoCore RAT Keepalive Response 1" (SID: 2810290, Rev: 7, Severity: 1) categorized as "A Network Trojan was detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Possible NanoCore C2 60B" (SID: 2025019, Rev: 1, Severity: 1) categorized as "Malware Command and Control Activity Detected" (PUA/PUP/Adware) Detected alert "ETPRO MALWARE NanoCore RAT Keep-Alive Beacon" (SID: 2816718, Rev: 3, Severity: 1) categorized as "A Network Trojan was detected" (PUA/PUP/Adware) Detected alert "ETPRO MALWARE NanoCore RAT Keepalive Response 3" (SID: 2810451, Rev: 5, Severity: 1) categorized as "A Network Trojan was detected" (PUA/PUP/Adware) Detected alert "ETPRO MALWARE Nanocore Checkin Pattern" (SID: 2823337, Rev: 2, Severity: 1) categorized as "Malware Command and Control Activity Detected" (PUA/PUP/Adware)2c:T8e0,".exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 952) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 952) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 952) ".exe" wrote 32 bytes to a remote process "C:\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe" (Handle: 864) ".exe" wrote 52 bytes to a remote process "C:\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe" (Handle: 864) ".exe" wrote 4 bytes to a remote process "C:\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe" (Handle: 864) ".exe" wrote 512 bytes to a remote process "C:\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe" (Handle: 864) ".exe" wrote 116736 bytes to a remote process "C:\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe" (Handle: 864) ".exe" wrote 89600 bytes to a remote process "C:\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe" (Handle: 864) "xQGPeospVmcjdT.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 952) "xQGPeospVmcjdT.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 952) "xQGPeospVmcjdT.exe" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 952) "xQGPeospVmcjdT.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\xQGPeospVmcjdT.exe" (Handle: 972) "xQGPeospVmcjdT.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\xQGPeospVmcjdT.exe" (Handle: 972) "xQGPeospVmcjdT.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\xQGPeospVmcjdT.exe" (Handle: 972) "xQGPeospVmcjdT.exe" wrote 512 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\xQGPeospVmcjdT.exe" (Handle: 972) "xQGPeospVmcjdT.exe" wrote 116736 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\xQGPeospVmcjdT.exe" (Handle: 972) "xQGPeospVmcjdT.exe" wrote 89600 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\xQGPeospVmcjdT.exe" (Handle: 972)2d:T4ff,Process "schtasks.exe" (UID: 00071716-00001072) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "schtasks.exe" (UID: 00071716-00001072) was launched with modified environment variables: "CommonProgramFiles, LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, PROCESSOR_ARCHITECTURE, HOMEPATH, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles, USERNAME" Process "fixxing.exe" (UID: 00071803-00002348) was launched with modified environment variables: "LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, HOMEPATH, TEMP, APPDATA, USERPROFILE, TMP, USERNAME" Process "DismHost.exe" (UID: 00079589-00001364) was launched with modified environment variables: "CommonProgramFiles, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles" Process "DismHost.exe" (UID: 00079589-00001364) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432, LOGONSERVER, HOMEPATH, HOMEDRIVE" Process "xQGPeospVmcjdT.exe" (UID: 00096196-00001728) was launched with new environment variables: "LOGONSERVER="\\HAPUBWS-PC", HOMEPATH="\Users\y9xkvAN", HOMEDRIVE="C:"" Process "xQGPeospVmcjdT.exe" (UID: 00096196-00001728) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP"2e:T284b,"vboxvideo.inf" (Indicator: "vbox") "2021-05-03 20:58:00, Error DISM DISM Driver Manager: PID=1364 Failed opening driver package for x86: INF Name='C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_54dffbe2252403f6\vboxguest.inf' - CDriverPackage::OpenDm" (Indicator: "vbox") "2021-05-03 20:58:00, Error DISM DISM Driver Manager: PID=1364 Failed opening driver package for x86: INF Name='C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_54dffbe2252403f6\vboxguest.inf' - CDriverPackage::OpenDm" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_282ccc1684d6e163\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vbox") "2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_bc42bb1917d1bc65\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vbox") "2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_e9f3789e40cc2499\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox") "2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox") "2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest")2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiIiIiIiIiIiIiIiIiIiACIiIiIiIiIiIiIiIiIiIgAiIiIiIiIiIiIiIh4iIiIAAiIiIiIiIiIiIiId3iIhwAAeIiIiIiIiIiIiHd3cAAAAHiIiIiIiIiIiIh3d3cAAAB4iIiIiIiIiIiId3d3cAAAeIiIiIiIiIiIiId3d4AAAHiIiIiIiIiIiIiIiIiAAAB4iIiIiIiIiIiIiIiIgAAAeIiIiP////////iIiIAAAHiIj/////////////iAAAB4////////////////8AAAf/////////////////AAAH/////////////////wAAB/////////////////8AAAf/////////////////AAAH/////////////////wAAB/////////////////8AAAf/////////////////BVVV/////////////////wVVVVVVVVVVVVVVVf////8FVVdVVVdVVVV1VVX/////BVVfVVh19VWIX1VV/////wVVX1VfVVVV9VWFVf////8FVV9VX1X1VfVYdVX/////BVVfVVX/9VVf/1VV/////wWFVVVVVVVVVVVV1f////8N3d3d3d3d3d3d3d//////Dd3Y/////////////////wAAB/////////////////8AAAf/////////////////DgAAAAwAAAAOAAAAD4AAAf+AAAD/gAAAf4AAAD+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABgAAAAfgAAAH4AAAB/AAAAw==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiIiIiIiIiIiIiIiIiIiACIiIiIiIiIiIiIiIiIiIgAiIiIiIiIiIiIiIh4iIiIAAiIiIiIiIiIiIiId3iIhwAAeIiIiIiIiIiIiHd3cAAAAHiIiIiIiIiIiIh3d3cAAAB4iIiIiIiIiIiId3d3cAAAeIiIiIiIiIiIiId3d4AAAHiIiIiIiIiIiIiIiIiAAAB4iIiIiIiIiIiIiIiIgAAAeIiIiP////////iIiIAAAHiIj/////////////iAAAB4////////////////8AAAf/////////////////AAAH/////////////////wAAB/////////////////8AAAf/////////////////AAAH/////////////////wAAB/////////////////8AAAf/////////////////BVVV/////////////////wVVVVVVVVVVVVVVVf////8FVVdVVVdVVVV1VVX/////BVVfVVh19VWIX1VV/////wVVX1VfVVVV9VWFVf////8FVV9VX1X1VfVYdVX/////BVVfVVX/9VVf/1VV/////wWFVVVVVVVVVVVV1f////8N3d3d3d3d3d3d3d//////Dd3Y/////////////////wAAB/////////////////8AAAf/////////////////DgAAAAwAAAAOAAAAD4AAAf+AAAD/gAAAf4AAAD+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABgAAAAfgAAAH4AAAB/AAAAw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790344001592,"unified_at":"2026-09-25T13:46:41.592Z","metadata":{"hashes":{"sha256":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f","sha1":"538871e91c9cac38af31bd09fe456843d841f586","md5":"0d50c8e7c3f044099056bfb318f108c6","sha512":"5364611735fe235a94a0339eae7511472eeab0b892e9e1a17da46f23802f82c4c2b225bed37953226a1b8b84d6711f16eee15f28254d5a4d68bc26e378b7c7ad","ssdeep":"12288:ctl3e+PHoCAQ1q5y/e2h3QFRiFD94KnBedBJmrRiD8pBf5rcrM:ctl3e+foC/q4oDiFJRBedOrQYpR5rm","ssdeep_chunks":["12288:ctl3e+P","12288:tl3e+PH","12288:l3e+PHo","12288:3e+PHoC","12288:e+PHoCA","12288:+PHoCAQ","12288:PHoCAQ1","12288:HoCAQ1q","12288:oCAQ1q5","12288:CAQ1q5y","12288:AQ1q5y/","12288:Q1q5y/e","12288:1q5y/e2","12288:q5y/e2h","12288:5y/e2h3","12288:y/e2h3Q","12288:/e2h3QF","12288:e2h3QFR","12288:2h3QFRi","12288:h3QFRiF","12288:3QFRiFD","12288:QFRiFD9","12288:FRiFD94","12288:RiFD94K","12288:iFD94Kn","12288:FD94KnB","12288:D94KnBe","12288:94KnBed","12288:4KnBedB","12288:KnBedBJ","12288:nBedBJm","12288:BedBJmr","12288:edBJmrR","12288:dBJmrRi","12288:BJmrRiD","12288:JmrRiD8","12288:mrRiD8p","12288:rRiD8pB","12288:RiD8pBf","12288:iD8pBf5","12288:D8pBf5r","12288:8pBf5rc","12288:pBf5rcr","12288:Bf5rcrM","24576:ctl3e+P","24576:tl3e+PH","24576:l3e+PHo","24576:3e+PHoC","24576:e+PHoCA","24576:+PHoCAQ","24576:PHoCAQ1","24576:HoCAQ1q","24576:oCAQ1q5","24576:CAQ1q5y","24576:AQ1q5y/","24576:Q1q5y/e","24576:1q5y/e2","24576:q5y/e2h","24576:5y/e2h3","24576:y/e2h3Q","24576:/e2h3QF","24576:e2h3QFR","24576:2h3QFRi","24576:h3QFRiF","24576:3QFRiFD","24576:QFRiFD9","24576:FRiFD94","24576:RiFD94K","24576:iFD94Kn","24576:FD94KnB","24576:D94KnBe","24576:94KnBed","24576:4KnBedB","24576:KnBedBJ","24576:nBedBJm","24576:BedBJmr","24576:edBJmrR","24576:dBJmrRi","24576:BJmrRiD","24576:JmrRiD8","24576:mrRiD8p","24576:rRiD8pB","24576:RiD8pBf","24576:iD8pBf5","24576:D8pBf5r","24576:8pBf5rc","24576:pBf5rcr","24576:Bf5rcrM","12288:ctl3e+f","12288:tl3e+fo","12288:l3e+foC","12288:3e+foC/","12288:e+foC/q","12288:+foC/q4","12288:foC/q4o","12288:oC/q4oD","12288:C/q4oDi","12288:/q4oDiF","12288:q4oDiFJ","12288:4oDiFJR","12288:oDiFJRB","12288:DiFJRBe","12288:iFJRBed","12288:FJRBedO","12288:JRBedOr","12288:RBedOrQ","12288:BedOrQY","12288:edOrQYp","12288:dOrQYpR","12288:OrQYpR5","12288:rQYpR5r","12288:QYpR5rm"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"fixxing.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":730112,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1619916765000,"last_seen":1678194906000,"last_multi_scan":1678194906000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["nanocore","adwind","agenttesla","alienspy","backdoor","banker","bladabindi","botnet","darkcomet","fareit","lokibot","mirai","netwire","njrat","rat","trojan"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":17,"suspicious_count":19,"malicious_count":12,"total":48},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.MSILKrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1251772","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILZilla.20","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.EDB.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Crypt (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AARL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:TrojanDropper/MSIL.PngPe.d","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Backdoor.MSIL.NanoBot.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"PWS-FCXL!0D50C8E7C3F0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/MSIL-SDM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.3144435","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Local Job Scheduling","attack_id":"T1168","attack_id_wiki":"https://attack.mitre.org/techniques/T1168","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Process deletes itself"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"tactic":"Command and Control","technique":"Uncommonly Used Port","attack_id":"T1065","attack_id_wiki":"https://attack.mitre.org/techniques/T1065","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe\" at 00064218-00003756-0000010C-3693812\n \".exe\" queries volume information of \"C:\\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe\" at 00066488-00004076-0000010C-3274820\n \"xQGPeospVmcjdT.exe\" queries volume information of \"%APPDATA%\\xQGPeospVmcjdT.exe\" at 00076169-00003452-0000010C-282286478","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")\n \"xQGPeospVmcjdT.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")\n \"xQGPeospVmcjdT.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.137.22.50:4557\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\tmpD400.tmp\"\n \"xQGPeospVmcjdT.exe\" created file \"%TEMP%\\tmpA9F4.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\CbvNEC\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"CbvNEC\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Global\\{cbea22e5-f897-4039-a352-cfbfd96fa986}\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"settings.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 68C70000\n \".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 684C0000\n \"xQGPeospVmcjdT.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 684F0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\xQGPeospVmcjdT\" /XML \"%TEMP%\\tmpD400.tmp\"\" (UID: 00066438-00002172)\n Spawned process \".exe\" (UID: 00066488-00004076)\n Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\xQGPeospVmcjdT\" /XML \"%TEMP%\\tmpA9F4.tmp\"\" (UID: 00078339-00002512)\n Spawned process \"xQGPeospVmcjdT.exe\" (UID: 00078363-00001680)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\xQGPeospVmcjdT\" /XML \"%TEMP%\\tmpD400.tmp\"\" (UID: 00066438-00002172)\n Spawned process \".exe\" (UID: 00066488-00004076)\n Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\xQGPeospVmcjdT\" /XML \"%TEMP%\\tmpA9F4.tmp\"\" (UID: 00078339-00002512)\n Spawned process \"xQGPeospVmcjdT.exe\" (UID: 00078363-00001680)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"xQGPeospVmcjdT.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"xQGPeospVmcjdT.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"xQGPeospVmcjdT.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"settings.bin\" has type \"data\"\n \"settings.bak\" has type \"data\"\n \"storage.dat\" has type \"data\"\n \"run.dat\" has type \"data\"\n \"tmpD400.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"\n \"catalog.dat\" has type \"data\"\n \"tmpA9F4.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"\n \"KB_151625079.dat\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"RogueButtons.My\"\n Heuristic match: \"Yko5Wf.dO\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"\n Pattern match: \"https://admin.neonova.net/index.php\"\n Pattern match: \"https://support.neonova.net/login.php\"\n Pattern match: \"https://calix.force.com/idp/login?app=0sp70000000001i#\"\n Pattern match: \"https://support.bandwidth.com/hc/en-us/restricted?return_to=https%3A%2F%2Fsupport.bandwidth.com%2Fhc%2Fen-us%2Frequests%2Fnew\"\n Pattern match: \"https://www.rtctel.com/\"\n Pattern match: \"http://schemas.microsoft.com/windows/2004/02/mit/task\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"xQGPeospVmcjdT.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"xQGPeospVmcjdT.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00064218-00003756-00000105-4273627\n \".exe\" at 00066488-00004076-00000105-3510416\n \"xQGPeospVmcjdT.exe\" at 00076169-00003452-00000105-282490077","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .text with unusual entropies 7.76210474352\n 7.76210474352","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\".exe\" (Thread ID: 1652) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"xQGPeospVmcjdT.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"xQGPeospVmcjdT.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds\n \"xQGPeospVmcjdT.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"xQGPeospVmcjdT.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"xQGPeospVmcjdT.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"xQGPeospVmcjdT.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe\" marked \"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\settings.bak\" for deletion\n \"%APPDATA%\\xQGPeospVmcjdT.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpA9F4.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\settings.bak\" with delete access\n \"xQGPeospVmcjdT.exe\" opened \"C:\\Users\\1kcivsF\\AppData\\Local\\Temp\\tmpA9F4.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"xQGPeospVmcjdT.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"xQGPeospVmcjdT.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"xQGPeospVmcjdT.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \".exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"xQGPeospVmcjdT.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\".exe\" created file \"%APPDATA%\\xQGPeospVmcjdT.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\".exe\" opened \"C:\\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1107","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"$2b","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"22/68 Antivirus vendors marked sample as malicious (32% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/33 Antivirus vendors marked sample as malicious (15% detection rate)\n 22/68 Antivirus vendors marked sample as malicious (32% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"25/87 Antivirus vendors marked dropped file \"xQGPeospVmcjdT.exe.bin\" as malicious (classified as \"Gen:Variant.Ursu\" with 28% detection rate)\n 25/87 Antivirus vendors marked dropped file \"xQGPeospVmcjdT.exe\" as malicious (classified as \"Gen:Variant.Ursu\" with 28% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"25/87 Antivirus vendors marked spawned process \".exe\" (PID: 4076) as malicious (classified as \"Gen:Variant.Ursu\" with 28% detection rate)\n 25/87 Antivirus vendors marked spawned process \"xQGPeospVmcjdT.exe\" (PID: 1680) as malicious (classified as \"Gen:Variant.Ursu\" with 28% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"\\RPC Control\\OLEED02C0696B314337B0D2CF6ADA8A\"\n \"xQGPeospVmcjdT.exe\" allocated memory in \"\\RPC Control\\OLEFBA9194BEBEE490197281E606EEC\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$2c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 45.137.22.50 on port 4557","origin":"Network Traffic","mitre_attack_id":"T1065","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\"\n \".exe\" checked file \"C:\\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00064218-00003756)\n Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\xQGPeospVmcjdT\" /XML \"%TEMP%\\tmpD400.tmp\"\" (UID: 00066438-00002172)\n Spawned process \".exe\" (UID: 00066488-00004076)\n Spawned process \"xQGPeospVmcjdT.exe\" (UID: 00076169-00003452)\n Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\xQGPeospVmcjdT\" /XML \"%TEMP%\\tmpA9F4.tmp\"\" (UID: 00078339-00002512)\n Spawned process \"xQGPeospVmcjdT.exe\" (UID: 00078363-00001680)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2d","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Process deletes itself","description":"\"C:\\fixxing.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":110,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":91,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["nanocore","adwind","agenttesla","alienspy","backdoor","banker","bladabindi","botnet","darkcomet","fareit","lokibot","mirai","netwire","njrat","rat","trojan"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6090a36f417ebf34033d827a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ursu","contacted_countries":["VNM"],"submit_name":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f","analysis_start_time":"2021-05-04T01:29:23+00:00","indicators_count":{"informative":16,"suspicious":23,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6090308fbfac6113ff1b9a46","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ursu","contacted_countries":["VNM"],"submit_name":"fixxing.exe","analysis_start_time":"2021-05-03T17:19:16+00:00","indicators_count":{"informative":16,"suspicious":23,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.137.22.50","port":4557,"protocol":"TCP","country":"Viet Nam","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}],"processes":[{"pid":3756,"ppid":0,"name":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe","command_line":"","sha256":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f","normalized_path":"C:\\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe","uid":"00064218-00003756","icon":"$2f"},{"pid":2172,"ppid":3756,"name":"schtasks.exe","command_line":"/Create /TN \"Updates\\xQGPeospVmcjdT\" /XML \"%TEMP%\\tmpD400.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00064218-00003756","uid":"00066438-00002172"},{"pid":4076,"ppid":3756,"name":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe","command_line":"","sha256":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f","normalized_path":"C:\\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe","parent_uid":"00064218-00003756","uid":"00066488-00004076"},{"pid":3452,"ppid":0,"name":"xQGPeospVmcjdT.exe","command_line":"","sha256":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f","normalized_path":"%APPDATA%\\xQGPeospVmcjdT.exe","uid":"00076169-00003452","icon":"$30"},{"pid":2512,"ppid":3452,"name":"schtasks.exe","command_line":"/Create /TN \"Updates\\xQGPeospVmcjdT\" /XML \"%TEMP%\\tmpA9F4.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00076169-00003452","uid":"00078339-00002512"},{"pid":1680,"ppid":3452,"name":"xQGPeospVmcjdT.exe","command_line":"","sha256":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f","normalized_path":"%APPDATA%\\xQGPeospVmcjdT.exe","parent_uid":"00076169-00003452","uid":"00078363-00001680"}],"all_imported_dlls":["System.Configuration.ni.dll","System.Xml.ni.dll","bcrypt.dll","rsaenh.dll","ntmarta.dll","apphelp.dll","user32.dll","nsi.dll","sspicli.dll","version.dll","rpcss.dll","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","msctf.dll","mscoreei.dll","psapi.dll","wininet.dll","usp10.dll","WSHTCPIP.DLL","kernel32.dll","RpcRtRemote.dll","System.Management.ni.dll","WMINet_Utils.dll","ntdsapi.dll","cryptbase.dll","System.Drawing.ni.dll","wship6.dll","fastprox.dll","System.Windows.Forms.ni.dll","shell32.dll","cryptsp.dll","GdiPlus.dll","clbcatq.dll","iertutil.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","vcruntime140_clr0400.dll","mscorrc.dll","ieframe.dll","imm32.dll","diasymreader.dll","ws2_32.dll","api-ms-win-core-synch-l1-2-0.dll","Microsoft.VisualBasic.ni.dll","urlmon.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","mscorlib.ni.dll","secur32.dll","gdi32.dll","KernelBase.dll","System.Windows.Forms.dll","tzres.dll","dwmapi.dll","wmiutils.dll","api-ms-win-core-xstate-l2-1-0.dll","nlssorting.dll","Wldap32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","oleaut32.dll","shlwapi.dll","profapi.dll","propsys.dll","api-ms-win-downlevel-version-l1-1-0.dll","ole32.dll","mscoree.dll","ucrtbase_clr0400.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","userenv.dll","cfgmgr32.dll","devobj.dll","mswsock.dll","wbemcomn.dll","msvcrt.dll","sechost.dll","clrjit.dll","setupapi.dll","lpk.dll","taskschd.dll","wbemprox.dll","ntdll.dll","advapi32.dll","rpcrt4.dll","clr.dll","System.ni.dll","clrcompression.dll","System.Core.ni.dll","comctl32.dll","System.Runtime.Remoting.ni.dll","WindowsCodecs.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","ktmw32.dll","wbemsvc.dll","uxtheme.dll","DismCorePS.dll","DmiProvider.dll","CbsCore.dll","wow64cpu.dll","LogProvider.dll","drvstore.dll","DismProv.dll","DrUpdate.dll","SPInf.dll","VxSSL64.dll","OSProvider.dll","wdscore.dll","SSShim.dll","dbghelp.dll","wow64.dll","wow64win.dll","mpr.dll","devrtl.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"xQGPeospVmcjdT.exe","sha256":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"xQGPeospVmcjdT.exe.bin","sha256":"91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"settings.bin","sha256":"f8098a6290118f2944b9e7c842bd014377d45844379f863b00d54515a8a64b48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"tmpA9F4.tmp","sha256":"51e0299f48591afea5e149cbcd1c2d8de3cfcaa76414c29652ac88ee41f5bcbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"name":"tmpD400.tmp","sha256":"51e0299f48591afea5e149cbcd1c2d8de3cfcaa76414c29652ac88ee41f5bcbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"name":"KB_151625079.dat","sha256":"31f18b7a6c4b7674df13e83115ac211b81a22af5c99d80577bd6edb0d130c8f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"name":"catalog.dat","sha256":"5347661365e7ad2c1acc27ab0d150ffa097d9246bb3626fca06989e976e8dd29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"run.dat","sha256":"b03e539ffb16bdaecbece3ee8886c568d45743e75632847c7bcb436deedc0975","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"settings.bak","sha256":"dc3ae604991c9bb8ff8bc4502ae3d0db8a3317512c0f432490b103b89c1a4368","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"storage.dat","sha256":"0bd3aac12623520c4e2031c8b96b4a154702f36f97f643158e91e987d317b480","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"DISMHOST.EXE.60906234.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"tmp120E.tmp","sha256":"d0cd21254839df466a179acbc492b0df4ad163405ab361ffec04da0b37623ebd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"KB_-1009648070.dat","sha256":"4ae120cff83afdef632914c0f54d45bb76487f0de4c79ed39df7a100d4d268b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"tmp757E.tmp","sha256":"d0cd21254839df466a179acbc492b0df4ad163405ab361ffec04da0b37623ebd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"dism.log","sha256":"4ca7001509e18e8ee7bfb8894c4edc1229ccce25226a05db5fd0338c924bf705","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]}],"files_written":[{"path":"%TEMP%\\tmpA9F4.tmp","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\xQGPeospVmcjdT.exe.config","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\xQGPeospVmcjdT.exe","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"C:\\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe.config","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"C:\\91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f.exe","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\catalog.dat","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\System32\\schtasks.exe","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\assembly\\pubpol247.dat","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\a891970b44db9e340c3ef3efa95b793c\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\fd0048cfdcd58dd454d2575e5cb55e70\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\System32\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%TEMP%\\tmpD400.tmp","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\run.dat","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\Logs","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\Logs\\1kcivsF","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\storage.dat","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\settings.bin","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\settings.bak","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\Logs\\1kcivsF\\KB_151625079.dat","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"path":"%APPDATA%\\xQGPeospVmcjdT.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%TEMP%\\tmp120E.tmp","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"C:\\fixxing.exe.config","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"C:\\fixxing.exe","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\assembly\\pubpol201.dat","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\0b2f69b43a576b9edcc807a30872bd91\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_amd64_neutral_1ade99e6e02a247f\\VBoxVideo.inf","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_amd64_neutral_1ade99e6e02a247f\\vboxvideo.PNF","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\Logs","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\Logs\\y9xkvAN","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\SysWOW64\\schtasks.exe","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\Logs\\y9xkvAN\\KB_-1009648070.dat","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\SysWOW64","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\settings.bin","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%TEMP%\\tmp757E.tmp","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\TEMP\\303B052E-4478-42DD-A72A-250377136AD4\\en-US\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\TEMP\\303B052E-4478-42DD-A72A-250377136AD4\\en\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\System32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\Logs\\DISM\\dism.log","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.23505_none_681aa442f6fed7f0\\CbsCore.dll","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\Temp\\303B052E-4478-42DD-A72A-250377136AD4\\en-US\\DmiProvider.dll.mui","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\inf\\oem12.inf","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\inf\\oem11.inf","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\run.dat","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\catalog.dat","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\storage.dat","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\settings.bak","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\CbvNEC","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"CbvNEC","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"Global\\{cbea22e5-f897-4039-a352-cfbfd96fa986}","sources":[{"report_type":"sandbox","report_id":"6090a36f417ebf34033d827a"},{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]},{"name":"\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"6090308fbfac6113ff1b9a46"}]}]}},"report_ids":{"sandbox_job_ids":["6090a36f417ebf34033d827a","6090308fbfac6113ff1b9a46"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware Sample 91f6fc2ae99e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 91f6fc2ae99e…. Malware family: Malware. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 91f6fc2ae99e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 91f6fc2ae99e…. Malware family: Malware. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/91f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 91f6fc2ae99e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 91f6fc2ae99e…. Malware family: Malware. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]