24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Jatif.Generic Sample 91f6fdf97a9a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 91f6fdf97a9a…. Malware family: Jatif.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75","keywords":["Malicious","Jatif.Generic","malware analysis","sandbox report","threat intelligence","91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Jatif.Generic","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1a9d,Contains base64 string in header "POST" in header "POST /main/main_board.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 21Host: www.ikrea.or.kr" Contains base64 string in header "Keep" in header "POST /main/main_board.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 21Host: www.ikrea.or.kr" Contains base64 string in header "AliveContent" in header "POST /main/main_board.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 21Host: www.ikrea.or.kr" Contains base64 string in header "Type" in header "POST /main/main_board.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 21Host: www.ikrea.or.kr" Contains base64 string in header "form" in header "POST /main/main_board.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 21Host: www.ikrea.or.kr" Contains base64 string in header "urlencodedAccept" in header "POST /main/main_board.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 21Host: www.ikrea.or.kr" Contains base64 string in header "Encoding" in header "POST /main/main_board.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 21Host: www.ikrea.or.kr" Contains base64 string in header "gzip" in header "POST /main/main_board.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 21Host: www.ikrea.or.kr" Contains base64 string in header "Language" in header "POST /main/main_board.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 21Host: www.ikrea.or.kr" Contains base64 string in header "like" in header "POST /main/main_board.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 21Host: www.ikrea.or.kr" Contains base64 string in header "GeckoContent" in header "POST /main/main_board.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 21Host: www.ikrea.or.kr" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: ikrea.co.kr" Contains base64 string in header "Encoding" in header "GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: ikrea.co.kr" Contains base64 string in header "gzip" in header "GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: ikrea.co.kr" Contains base64 string in header "Language" in header "GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: ikrea.co.kr" Contains base64 string in header "like" in header "GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: ikrea.co.kr"26:T80e,"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005752)27:T728,"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00005752)28:T2017,"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005752)29:T95a,"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74e10000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74e10000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74e10000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "KERNEL32" at base 75720000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73620000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "USER32.DLL" at base 75810000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "ADVAPI32.DLL" at base 76cc0000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "NTDLL.DLL" at base 76fb0000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "WINMM.DLL" at base 74c60000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "NTDLL" at base 76fb0000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "KERNEL32.DLL" at base 75720000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "WINHTTP.DLL" at base 73430000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73410000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "RPCRT4.DLL" at base 75550000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73840000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "SSPICLI.DLL" at base 739a0000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73380000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73320000 "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 744900002a:T503,"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" searching for class "OLLYDBG" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" searching for class "GBDYLLO" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" searching for class "pediy06" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" searching for class "FilemonClass" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" searching for window "File Monitor - Sysinternals: www.sysinternals.com" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" searching for class "PROCMON_WINDOW_CLASS" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" searching for window "Process Monitor - Sysinternals: www.sysinternals.com" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" searching for class "RegmonClass" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" searching for window "Registry Monitor - Sysinternals: www.sysinternals.com" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" searching for class "18467-41" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" searching for class "Regmonclass"2b:T4d5,The input sample is signed with a certificate issued by "CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 61:70:8A:3A:2B:AE:53:43:FF:76:4D:E7:82:D7:F3:44:15:1F:2B:74; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:8F:1B:57:33:0D:BB:A2:D0:7A:6C:51:F7:0E:E9:0D:DA:B9:AD:8E; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 94:C9:5D:A1:E8:50:BD:85:20:9A:4A:2A:F3:E1:FB:16:04:F9:BB:66; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 61:4D:27:1D:91:02:E3:01:69:82:24:87:FD:E5:DE:00:A3:52:B0:1D; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 19:A0:9B:5A:36:F4:DD:99:72:7D:F7:83:C1:7A:51:23:1A:56:C1:17; see report for more information)2c:T6de,"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")2d:Tf2d,"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "91F6FDF97A9AAB278EC63156A8DEECA616ABB968C81A14DC5713D9918F7EEB75.EXE"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "")2e:T80a,"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22621.608_none_42d541138da2ebd2\comctl32.dll" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\SysWOW64\rpcrt4.dll" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\SysWOW64\advapi32.dll" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll"2f:Tcca,"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")30:T62a,"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-1991939155 [PID: 5752] "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-1991946021 [PID: 5752] "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-1992624553 [PID: 5752] "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-1992631520 [PID: 5752] "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-1992796087 [PID: 5752] "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-1992804450 [PID: 5752] "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-1993067387 [PID: 5752] "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-1993093492 [PID: 5752] "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-1995379662 [PID: 5752] "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-1995386721 [PID: 5752]31:T6e7,"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32NextW with parameter System" (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32NextW with parameter Registry" (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00005752) "91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00005752)32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiIiIiIiId4dmZneIiAAAAIiIiIiHZodmZkZmZ4iIAACIiIiIZmhmZmZmZwAAAAgAiIiIhmaGZmZmYAAAAAAAgIiIh2ZmZmZmZmQAAAAAAICIiIZmZmZoiGZkAAAAAAAAiIhmZmZoiIgARAAAAAAAAIiGZmZmiIiIAAAAAAAAAACIhmZoiIiIiAAAAAAAAACIiHZmaIiIiIgAAAAAAACIiIhmZmiIiIiIAAAAAACIiIiHZmZniIiIiIAACIiIiIiIhmZmZoiIiIiIiIiIiIiIgIZmZmZ4iId4iIiIiIiIiICGZmZmaIiIZoiIiIiIiIAAhmZmZmaIiGZ4iIiIiIgAAIbuZmZmaIdmaIiIiIgAAAD27uZmZmZmZmYAAAAAAAAE9u7uZmZmZmZmAAAAAAAERPfu7uZmZmZmZgAAAAAERET37u7mZmZmZmZmZmZmZmZA93iI7mZmZmZmZmZmZmZkAP94iI7mZmZmZmZmZmZmZAD/d4iI5mZmZmZmZmZmZmAA//eIiI5mZmZmYAAGZmZgAP//eIiI5mZmZmZmZmZmYAD//36IiIhmZmZmZmZmZgAA///+6IiIh2ZmZmZmZmAAAP//fu6IiIh2ZmZmZmYAAAD//36O54iIh2ZmZmZgAAAA//iIiGZmZmZmZmZmAAAAAP94iIb///ZmZmZgAAAAAAD8AAA/8AAAD+AAA/uAAB/9gAAP/QAHD/8AEc//ADD//wBw//wAEP/wAAD/wAAAeACAAAABgAAAAYAAAAeAAAAPgAAAP4AAP/6AAD/4gAA/4IAAAAGAAAADwAAAA8AAAAfgAB4H8AAAB/AAAA/4AAAf8AAAP/AAAH/gAAD/wPgH/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791064652973,"unified_at":"2026-10-03T21:57:32.973Z","metadata":{"hashes":{"sha256":"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75","sha1":"3d311117d09f4a6ad300e471c2fb2b3c63344b1d","md5":"20183332c370b9d35d368083ecb74d22","sha512":"c497beff2a5d500f2d80b3f10974d3a1559b7c1027fca440c222469a53be60fd41c6f796cc0385a7e1813f369ac85106e68c18eb5bbfc6a206cb9eefe95b97b3","ssdeep":"24576:m/hQQsEc0S6YXTFuInaf/jEqVasbIh8e2us1F/IE4dkTSz3lCk:mmaS6EEIa3Ppb1V/3yIk","ssdeep_chunks":["24576:m/hQQsE","24576:/hQQsEc","24576:hQQsEc0","24576:QQsEc0S","24576:QsEc0S6","24576:sEc0S6Y","24576:Ec0S6YX","24576:c0S6YXT","24576:0S6YXTF","24576:S6YXTFu","24576:6YXTFuI","24576:YXTFuIn","24576:XTFuIna","24576:TFuInaf","24576:FuInaf/","24576:uInaf/j","24576:Inaf/jE","24576:naf/jEq","24576:af/jEqV","24576:f/jEqVa","24576:/jEqVas","24576:jEqVasb","24576:EqVasbI","24576:qVasbIh","24576:VasbIh8","24576:asbIh8e","24576:sbIh8e2","24576:bIh8e2u","24576:Ih8e2us","24576:h8e2us1","24576:8e2us1F","24576:e2us1F/","24576:2us1F/I","24576:us1F/IE","24576:s1F/IE4","24576:1F/IE4d","24576:F/IE4dk","24576:/IE4dkT","24576:IE4dkTS","24576:E4dkTSz","24576:4dkTSz3","24576:dkTSz3l","24576:kTSz3lC","24576:TSz3lCk","49152:m/hQQsE","49152:/hQQsEc","49152:hQQsEc0","49152:QQsEc0S","49152:QsEc0S6","49152:sEc0S6Y","49152:Ec0S6YX","49152:c0S6YXT","49152:0S6YXTF","49152:S6YXTFu","49152:6YXTFuI","49152:YXTFuIn","49152:XTFuIna","49152:TFuInaf","49152:FuInaf/","49152:uInaf/j","49152:Inaf/jE","49152:naf/jEq","49152:af/jEqV","49152:f/jEqVa","49152:/jEqVas","49152:jEqVasb","49152:EqVasbI","49152:qVasbIh","49152:VasbIh8","49152:asbIh8e","49152:sbIh8e2","49152:bIh8e2u","49152:Ih8e2us","49152:h8e2us1","49152:8e2us1F","49152:e2us1F/","49152:2us1F/I","49152:us1F/IE","49152:s1F/IE4","49152:1F/IE4d","49152:F/IE4dk","49152:/IE4dkT","49152:IE4dkTS","49152:E4dkTSz","49152:4dkTSz3","49152:dkTSz3l","49152:kTSz3lC","49152:TSz3lCk","24576:mmaS6EE","24576:maS6EEI","24576:aS6EEIa","24576:S6EEIa3","24576:6EEIa3P","24576:EEIa3Pp","24576:EIa3Ppb","24576:Ia3Ppb1","24576:a3Ppb1V","24576:3Ppb1V/","24576:Ppb1V/3","24576:pb1V/3y","24576:b1V/3yI","24576:1V/3yIk"],"imphash":"baa93d47220682c04d92f7797d9224ce"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1254696,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1595207066000,"last_seen":1733524368000,"last_multi_scan":1733524368000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["downloader","evasive","coinminer"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":34},"sandbox_signatures":{"informative_count":60,"suspicious_count":20,"malicious_count":5,"total":85},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[APT]/Win32.Lazarus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Lazarus.Y","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jatif.1813","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jatif.1813 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/NukeSped.HW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!72188A8C98D4A518","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0056bc631 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"BACKDOOR/Nukesped.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"ATK/APosT-X","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agent.1254696","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.COLL-2658","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Malware-Cryptor.SB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_44.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Themida.Win32.54440","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Jatif.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Queries process information"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains reference to Sysinternals URL"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Creates/Opens a system file in windows directory"}],"sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/techniques/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$25","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.946246050251027","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005752-00000C29-1992640573\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" called \"IsWow64Process\" with parameter \"5752\" - (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" called \"GetWindowTextA\" with parameter \"Program Manager\" - (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA UDPv4 invalid checksum\" (SID: 2200075, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.ikrea.or.kr\"\n \"ikrea.co.kr\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"49.50.163.51:80\"\n \"116.126.87.199:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"lstrcpy\"; File: \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005752-0000044C-2454269224\")\n Found string \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005752-0000044C-2454876160\")\n Found string \"Registry Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005752-0000044C-2459967824\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:5752:168:WilStaging_02\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nHost: ikrea.co.kr\" Response ==> HTTP/1.1 200 OK\nDate: Fri\n 06 Dec 2024 22:33:37 GMT\nServer: Apache\nSet-Cookie: vslog=1; expires=Sat\n 07-Dec-2024 22:33:38 GMT; Max-Age=86400; path=/; domain=ikrea.co.kr; HttpOnly\nConnection: close\nTransfer-Encoding: chunked\nContent-Type: text/html; charset=UTF-8 with response body ==>376334350D0A3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D226B6F223E0A093C686561643E0A09093C6D65746120687474702D65717569.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75550000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" was detected as \"Themida/Winlicense\" and name: \"Protector\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has an executable section named \"\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has an executable section named \"aggidfxa\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has an executable section named \"sakaxnla\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has an writable section named \"\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has an writable section named \".rsrc\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has an writable section named \".idata\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has an writable section named \"aggidfxa\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has an writable section named \"sakaxnla\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" file has an entrypoint instructions - \"sub\tesp, 4,push\teax,push\tebx,call\t0x72e00b,int3\t,pop\teax,mov\tebx, eax,inc\teax,sub\teax, 0x11e000,sub\teax, 0x100c0daf,add\teax, 0x100c0da4,cmp\tbyte ptr [ebx], 0xcc,jne\t0x72e03c,mov\tbyte ptr [ebx], 0,mov\tebx, 0x1000,push\t0x6803c8c1,push\t0x3ed338a6,push\tebx,push\teax,call\t0x72e046,add\teax, 0,mov\tdword ptr [esp + 8], eax,pop\tebx,pop\teax,ret\t,push\tebp,mov\tebp, esp,push\teax,push\tebx,push\tecx,push\tesi,mov\tesi, dword ptr [ebp + 8],mov\tecx, dword ptr [ebp + 0xc],shr\tecx, 2,mov\teax, dword ptr [ebp + 0x10],mov\tebx, dword ptr [ebp + 0x14],test\tecx, ecx,je\t0x72e06a,xor\tdword ptr [esi], eax,add\tdword ptr [esi], ebx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"aggidfxa\" is \"0x11d600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x1e8000\" greater than 0x100000\n Virtual size of \"aggidfxa\" is \"0x11e000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ikrea.co.kr\"\n \"www.ikrea.or.kr\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"$2a","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2b","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" queries basic process information of the \"C:\\91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" (UID: 5752)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Able to identify virtual environment by using API string","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" trying to access non-existent file \"C:\\winmm.dll\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" trying to access non-existent file \"C:\\WINHTTP.dll\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" trying to access non-existent file \"C:\\webio.dll\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" trying to access non-existent file \"C:\\IPHLPAPI.DLL\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" trying to access non-existent file \"C:\\winnlsres.dll\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" trying to access non-existent file \"C:\\SspiCli.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"b74648\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"b74648\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /main/main_board.asp\"\n Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"3.6.0.3\" found in string \"DreamSecurity Handler Manager 3.6.0.3\"\n \"3.6.0.3\"\n Potential IP \"3.6.0.3\" found in string \"Handler Manager 3.6.0.3\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"e?.fo\"\n Heuristic match: \"xy.aw\"\n Heuristic match: \":_b.mt\"\n Pattern match: \"www.ikrea.or.kr\"\n Pattern match: \"www.ikrea.or.krfn=delfino.gif&code=2\"\n Heuristic match: \"ikrea.co.kr\"\n Heuristic match: \"get / http/1.1cache-control: no-cacheconnection: keep-aliveaccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8accept-encoding: gzip, deflateaccept-language: ko-kr;q=0.8,ko;q=0.6,ko-kr;q=0.4,ko;q=0.2user-agent: mozilla/5.0 (windows nt 6.\"\n Pattern match: \"www.sysinternals.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 1fee42860921e80528fe261368c08c90","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$30","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" is setting 'ThreadHideFromDebugger' data for its current thread","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe queries ProcessDebugPort (UID: 5752)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has section name with entropy \"7.97685402345\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has section name .rsrc with entropy \"7.60645274878\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has section name aggidfxa with entropy \"7.94820714862\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"\"POST /main/main_board.asp HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nContent-Length: 21\nHost: www.ikrea.or.kr\" with payload::==> \"fn=delfino.gif&code=2\" HTTP/1.1 301 Moved Permanently\nDate: Fri\n 06 Dec 2024 22:33:37 GMT\nP3P: CP=\"NOI CURa ADMa DEVa TAIa OUR DELa BUS IND PHY ONL UNI COM NAV INT DEM PRE\"\nLocation: http://ikrea.co.kr\nContent-Length: 0\nContent-Type: text/html; charset=euc-kr\nAge: 0\nConnection: keep-alive with response body ==>.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 49.50.163.51 on port 80 is sent without HTTP header\n TCP traffic to 116.126.87.199 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$31","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has an entrypoint in section \"sakaxnla\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has a section named \"\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has a section named \"aggidfxa\"\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75\" has a section named \"sakaxnla\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\SysWOW64\\ntdll.dll\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"\n \".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"OLLYDBG\" (Indicator: \"ollydbg\")\n \"GBDYLLO\" (Indicator: \"gbdyllo\")\n \"pediy06\" (Indicator: \"pediy06\")\n \"FilemonClass\" (Indicator: \"filemonclass\")\n \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"file monitor\")\n \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"sysinternals\")\n \"PROCMON_WINDOW_CLASS\" (Indicator: \"procmon_window_class\")\n \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"process monitor\")\n \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"sysinternals\")\n \"Registry Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"sysinternals\")","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/89 reputation engines marked \"http://crt.sectigo.com\" as malicious (2% detection rate)\n 1/89 reputation engines marked \"http://crl.sectigo.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"raymondjburkett@protonmail.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 9300224)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 9300224)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"711157007a3b5600ab8b02007f950200fc8c0200729602006cc805001ecd53007d265300\" to virtual address \"0x776107E4\" (part of module \"USER32.DLL\")\n \".exe\" wrote bytes \"0efcb57781edb477ae86b377c6e0b277effdb5772d16b477c0fcb177da8fbc776014b677478db377a8e2b2776089b37700000000ad37cc758b2dcc75b641cc7500000000\" to virtual address \"0x74061000\" (part of module \"WSHIP6.DLL\")\n \".exe\" wrote bytes \"7d07b67781edb477ae86b377c6e0b277effdb5772d16b4776014b677478db377a8e2b2776089b37700000000ad37cc758b2dcc75b641cc7500000000\" to virtual address \"0x74071000\" (part of module \"WSHTCPIP.DLL\")\n \".exe\" wrote bytes \"c0dfb2771cf9b177ccf8b1770d64b37700000000c0119d7500000000fc3e9d7500000000e0139d75000000009457667625e0b277c6e0b27700000000bc6a657600000000cf319d750000000093196676000000002c329d7500000000\" to virtual address \"0x75C81000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"20/37 Antivirus vendors marked sample as malicious (54% detection rate)\n 53/69 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"20/37 Antivirus vendors marked sample as malicious (54% detection rate)\n 53/69 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"malicious","category":"Installation/Persistence","name":"Creates/Opens a system file in windows directory","description":"\".exe\" created file \"%WINDIR%\\SysWOW64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1036","relevance":7,"id":"api-5","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /main/main_board.asp HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nContent-Length: 21\nHost: www.ikrea.or.kr\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"InitCommonControls\" (Source: 91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.bin, API is part of module: COMCTL32.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"???\n .rsrc\n aggidfxa with unusual entropies 7.97685402345\n 7.60645274878\n 7.94820714862","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":54,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["downloader","evasive","coinminer"],"sample_flags":["Network Traffic","TOR analysis"],"sandbox_reports":[{"id":"67537b8f92aa0f3937018e4b","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["KOR"],"submit_name":"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75","analysis_start_time":"2024-12-06T22:32:48+00:00","indicators_count":{"informative":58,"suspicious":16,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"611c46a412cfa26b99097340","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Jatif","submit_name":"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75","analysis_start_time":"2021-08-17T23:30:49+00:00","indicators_count":{"informative":6,"suspicious":12,"malicious":5},"is_in_unified_schema":true},{"id":"5fb567fd57873d58fc7580db","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["KOR"],"submit_name":"tmpwet2p7ir","analysis_start_time":"2020-11-18T18:29:26+00:00","indicators_count":{"informative":7,"suspicious":13,"malicious":5},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"5fb55a75f87f9c75db5212a0","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":95,"malware_family":"Trojan.Generic","contacted_countries":["KOR"],"submit_name":"file","analysis_start_time":"2020-11-18T17:31:37+00:00","indicators_count":{"informative":8,"suspicious":15,"malicious":5},"tags":["Network Traffic","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"49.50.163.51","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"address":"116.126.87.199","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"address":"211.174.62.33","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]}],"dns_resolutions":[{"domain":"ikrea.co.kr","address":"116.126.87.199","ttl":3600,"country":"Korea, Republic of","registrar_name":"Whois Corp.(http://whois.co.kr)","registrar_name_servers":"ns1.whoisdomain.kr","registrar_creation_date":"2023-07-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"domain":"www.ikrea.or.kr","address":"49.50.163.51","ttl":3600,"country":"Korea, Republic of","registrar_name":"Whois Corp.(http://whois.co.kr)","registrar_name_servers":"ns3.onkr.com","registrar_creation_date":"2005-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]}],"http_requests":[{"host":"www.ikrea.or.kr","host_ip":"49.50.163.51:80","url":"/main/main_board.asp","method":"POST","response_code":"301","response_phrase":"Moved Permanently","header":"POST /main/main_board.asp HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nContent-Length: 21\nHost: www.ikrea.or.kr","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"host":"ikrea.co.kr","host_ip":"116.126.87.199:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: ko-KR;q=0.8,ko;q=0.6,ko-KR;q=0.4,ko;q=0.2\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nHost: ikrea.co.kr","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}],"processes":[{"pid":5752,"ppid":0,"name":"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe","command_line":"","sha256":"91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75","normalized_path":"C:\\91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75.exe","uid":"00000000-00005752","icon":"$32"}],"all_imported_dlls":["winnsi.dll","sspicli.dll","VxSSL32.dll","ntdll.dll","wow64base.dll","KernelBase.dll","sechost.dll","rpcrt4.dll","gdi32.dll","user32.dll","kernel32.dll","win32u.dll","winmm.dll","mswsock.dll","rasadhlp.dll","fltLib.dll","combase.dll","winhttp.dll","nsi.dll","kernel.appcore.dll","advapi32.dll","ws2_32.dll","ole32.dll","wow64cpu.dll","apphelp.dll","comctl32.dll","gdi32full.dll","msvcp_win.dll","OnDemandConnRouteHelper.dll","ucrtbase.dll","imm32.dll","IPHLPAPI.DLL","FWPUCLNT.DLL","wow64win.dll","wow64con.dll","cryptsp.dll","dnsapi.dll","wow64.dll","msvcrt.dll","oleaut32.dll","webio.dll","api-ms-win-core-synch-l1-2-0.dll","dhcpcsvc6.dll","dhcpcsvc.dll","credssp.dll","WSHTCPIP.DLL","cfgmgr32.dll","cryptbase.dll","shlwapi.dll","lpk.dll","msctf.dll","wship6.dll","usp10.dll","wshqos.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\SysWOW64\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"path":"%WINDIR%\\System32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"key":"SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:5752:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"67537b8f92aa0f3937018e4b"},{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"611c46a412cfa26b99097340"},{"report_type":"sandbox","report_id":"5fb567fd57873d58fc7580db"},{"report_type":"sandbox","report_id":"5fb55a75f87f9c75db5212a0"}]}]}},"report_ids":{"sandbox_job_ids":["5fb567fd57873d58fc7580db","67537b8f92aa0f3937018e4b","611c46a412cfa26b99097340","5fb55a75f87f9c75db5212a0"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Jatif.Generic Sample 91f6fdf97a9a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 91f6fdf97a9a…. Malware family: Jatif.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75"}],["$","meta","4",{"property":"og:title","content":"Malicious Jatif.Generic Sample 91f6fdf97a9a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 91f6fdf97a9a…. Malware family: Jatif.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Jatif.Generic Sample 91f6fdf97a9a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 91f6fdf97a9a…. Malware family: Jatif.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]