21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 25:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T42e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 93e11f10ae56… — Score 75/100 — Hybrid Analysis","description":"Suspicious verdict for sample 93e11f10ae56…. Threat score 75/100. 0/28 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/93e11f10ae560d30da40f2215914cd7c5dc87c6767f8b2e5e3f7cdc8ed94046e","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","93e11f10ae560d30da40f2215914cd7c5dc87c6767f8b2e5e3f7cdc8ed94046e"],"about":{"@type":"SoftwareApplication","name":"scriptinterpreter.exe","applicationCategory":["peexe","executable"],"identifier":"93e11f10ae560d30da40f2215914cd7c5dc87c6767f8b2e5e3f7cdc8ed94046e","additionalType":"Suspicious sample"},"threatScore":75,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T48c,"" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui" "" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "" touched file "C:\Windows\SysWOW64\netmsg.dll" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "scriptinterpreter.tmp" touched file "C:\Windows\Fonts\StaticCache.dat" "scriptinterpreter.tmp" touched file "C:\Windows\SysWOW64\en-US\user32.dll.mui" "scriptinterpreter.tmp" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "scriptinterpreter.tmp" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui" "scriptinterpreter.tmp" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "scriptinterpreter.tmp" touched file "C:\Windows\SysWOW64\netmsg.dll" "scriptinterpreter.tmp" touched file "C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\comctl32.dll.mui" "scriptinterpreter.tmp" touched file "C:\Windows\SysWOW64\shfolder.dll" "scriptinterpreter.tmp" touched file "C:\Windows\SysWOW64\imageres.dll"23:Tf05,Pattern match: "http://schemas.microsoft.com/SMI/2" Pattern match: "www.digicert.com110/" Pattern match: "http://crl3.digicert.com/sha2-assured-cs-g1.crl05" Pattern match: "http://crl4.digicert.com/sha2-assured-cs-g1.crl0L" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0N" Pattern match: "cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0" Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O" Pattern match: "www.digicert.com1!0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDCA-1.crl08" Pattern match: "crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0" Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" Heuristic match: "GOG.com" Pattern match: "http://dmd.metaservices.microsoft.com/dms/metadata.svc" Pattern match: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ab7df5a16da4055b HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?7de15e8531e07b60 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s2.symcb.com" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBuN56dlW1Lzehhu%2FtdSD3U%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcd.com" Pattern match: "http://www.symauth.com/cps0*" Heuristic match: "GET /CRL/Omniroot2025.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cdp1.public-trust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAt%2BEJA8OEkP%2Bi9nmoehp7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSLIycRsoI3J6zPns4K1aQgAqaqHgQUZ50PIAkMzIo65YJGcmL88cyQ5UACEAG2Yem3HYLmNssdMr3TCFk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAb1bdOFOAGOmjEkh5bmQKs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Pattern match: "http://schemas.microsoft.com/SMI/2005/Windo" Heuristic match: "COMMAND.COM" Pattern match: "http://www.innosetup.com/" Pattern match: "http://www.remobjects.com/ps" Pattern match: "http://schemas.microsoft.com/SMI/20"24:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAEzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMwAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzADMzMzMzMzMzMzMzMzMzMwAzMzMzMzeIiIgzMzMzMzMAMzMzMzeP////+DMzMzMzADMzO7OP///////4MzMzMwAzO7s4/////////4MzMzMAM7u7j//////////3MzMzALu7u///////////+DMzMwC7u7j/////iP////9zMzMAu7u4////i4i4////gzMzALu7v////7iIi/////MzMwC7u7////iLu7iP///zMzMAu7u////4i7u4j///8zMzALu7v///+Ii7i4////MzMwC7u7////+4iIj///+DMzMAu7u4////+LuP////gzMzALu7u////////////7uzMwC7u7uP//////////i7szMAu7u7v//////////7u7szALu7u7v/////////u7u7swC7u7u7uP//////i7u7u7MAu7u7u7u4////i7u7u7uzALu7u7u7u7u7u7u7u7u7swC7u7u7u7u7u7u7u7u7u7MAu7u7u7u7u7u7u7u7u7u7ALu7u7u7u7u7u7u7u7u7uwC7u7u7u7u7u7u7u7u7u7MAAzMzMzMzMzMzMzMzMzMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAQ==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"93e11f10ae560d30da40f2215914cd7c5dc87c6767f8b2e5e3f7cdc8ed94046e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":75,"unified_at_epoch_ms":1790385717469,"unified_at":"2026-09-26T01:21:57.469Z","metadata":{"hashes":{"sha256":"93e11f10ae560d30da40f2215914cd7c5dc87c6767f8b2e5e3f7cdc8ed94046e","sha1":"22c588cd11a6d47bec0a64d143fb6d90d4b7db65","md5":"3a227efce6b03b5fe5ed0a8cc123380c","sha512":"227852eef28a46d908c84ddcd38625f7ba390da01404cb1f94caa495d2dbb98807f6393d78c235820a273a40b5f815b7f44fbec9fbad951fba3d1071bececc5f","ssdeep":"24576:0/ot1NCk8tRw4652mwloerEp1copOOOWuDZJmbvQqk8NmJnGwNNoL3VTtlP:6Wg7G46+oeryxvbvo8NaBNOrVplP","ssdeep_chunks":["24576:0/ot1NC","24576:/ot1NCk","24576:ot1NCk8","24576:t1NCk8t","24576:1NCk8tR","24576:NCk8tRw","24576:Ck8tRw4","24576:k8tRw46","24576:8tRw465","24576:tRw4652","24576:Rw4652m","24576:w4652mw","24576:4652mwl","24576:652mwlo","24576:52mwloe","24576:2mwloer","24576:mwloerE","24576:wloerEp","24576:loerEp1","24576:oerEp1c","24576:erEp1co","24576:rEp1cop","24576:Ep1copO","24576:p1copOO","24576:1copOOO","24576:copOOOW","24576:opOOOWu","24576:pOOOWuD","24576:OOOWuDZ","24576:OOWuDZJ","24576:OWuDZJm","24576:WuDZJmb","24576:uDZJmbv","24576:DZJmbvQ","24576:ZJmbvQq","24576:JmbvQqk","24576:mbvQqk8","24576:bvQqk8N","24576:vQqk8Nm","24576:Qqk8NmJ","24576:qk8NmJn","24576:k8NmJnG","24576:8NmJnGw","24576:NmJnGwN","24576:mJnGwNN","24576:JnGwNNo","24576:nGwNNoL","24576:GwNNoL3","24576:wNNoL3V","24576:NNoL3VT","24576:NoL3VTt","24576:oL3VTtl","24576:L3VTtlP","49152:0/ot1NC","49152:/ot1NCk","49152:ot1NCk8","49152:t1NCk8t","49152:1NCk8tR","49152:NCk8tRw","49152:Ck8tRw4","49152:k8tRw46","49152:8tRw465","49152:tRw4652","49152:Rw4652m","49152:w4652mw","49152:4652mwl","49152:652mwlo","49152:52mwloe","49152:2mwloer","49152:mwloerE","49152:wloerEp","49152:loerEp1","49152:oerEp1c","49152:erEp1co","49152:rEp1cop","49152:Ep1copO","49152:p1copOO","49152:1copOOO","49152:copOOOW","49152:opOOOWu","49152:pOOOWuD","49152:OOOWuDZ","49152:OOWuDZJ","49152:OWuDZJm","49152:WuDZJmb","49152:uDZJmbv","49152:DZJmbvQ","49152:ZJmbvQq","49152:JmbvQqk","49152:mbvQqk8","49152:bvQqk8N","49152:vQqk8Nm","49152:Qqk8NmJ","49152:qk8NmJn","49152:k8NmJnG","49152:8NmJnGw","49152:NmJnGwN","49152:mJnGwNN","49152:JnGwNNo","49152:nGwNNoL","49152:GwNNoL3","49152:wNNoL3V","49152:NNoL3VT","49152:NoL3VTt","49152:oL3VTtl","49152:L3VTtlP","24576:6Wg7G46","24576:Wg7G46+","24576:g7G46+o","24576:7G46+oe","24576:G46+oer","24576:46+oery","24576:6+oeryx","24576:+oeryxv","24576:oeryxvb","24576:eryxvbv","24576:ryxvbvo","24576:yxvbvo8","24576:xvbvo8N","24576:vbvo8Na","24576:bvo8NaB","24576:vo8NaBN","24576:o8NaBNO","24576:8NaBNOr","24576:NaBNOrV","24576:aBNOrVp","24576:BNOrVpl","24576:NOrVplP"],"imphash":"20dd26497880c05caed9305b3c8b9109"},"file_info":{"file_name":"scriptinterpreter.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1159792,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1520827335000,"last_seen":1678635853000,"last_multi_scan":1678635853000}},"detections":{"summary":{"verdict":"suspicious","score":75,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":22,"suspicious_count":10,"malicious_count":4,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00012796-00000448-4992-123-008496BC\n GetLocalTime@KERNEL32.DLL at 00012796-00000448-4992-432-008495E0\n GetLocalTime@kernel32.dll at 60191-2530-004084F4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@kernel32.dll at 59004-1174-004067DC\n GetVersion@kernel32.dll at 59004-1485-004067D4\n GetVersion@kernel32.dll at 59004-1182-004011A0\n GetVersionExW@KERNEL32.DLL at 00012283-00004176-63193-194-009667DC\n GetVersion@KERNEL32.DLL at 00012283-00004176-63193-549-009667D4\n GetVersion@KERNEL32.DLL at 00012283-00004176-63193-201-009611A0\n GetVersion@KERNEL32.DLL at 00012796-00000448-4992-1400-008413B4\n GetVersionExW@KERNEL32.DLL at 00012796-00000448-4992-1394-008496E4\n GetVersion@KERNEL32.DLL at 00012796-00000448-4992-1248-008496DC\n GetVersion@kernel32.dll at 60191-1448-00401394\n GetVersion@kernel32.dll at 60191-3796-004085A8\n GetVersionExW@kernel32.dll at 60191-4432-004085B0\n GetVersion@kernel32.dll at 6205-2867-004013B4\n GetVersionExW@kernel32.dll at 6205-2860-004096E4\n GetVersionExW@kernel32.dll at 6205-9803-004096EC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@kernel32.dll at 59004-1367-004066E0\n GetDiskFreeSpaceW@KERNEL32.DLL at 00012283-00004176-63193-434-009666E0\n GetDiskFreeSpaceW@KERNEL32.DLL at 00012796-00000448-4992-3417-00849598\n GetDiskFreeSpaceW@kernel32.dll at 60191-2515-004084CC\n GetDiskFreeSpaceW@kernel32.dll at 6205-4832-00409598","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"scriptinterpreter.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCRIPTINTERPRETER.TMP\")\n \"scriptinterpreter.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCRIPTINTERPRETER.TMP\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/67 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"92.122.122.146:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.DLL at 00012796-00000448-4992-1346-00849478","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\is-96JA5.tmp\\scriptinterpreter.tmp\"\n \"scriptinterpreter.tmp\" created file \"%TEMP%\\Setup Log 2018-03-12 #001.txt\"\n \"scriptinterpreter.tmp\" created file \"%TEMP%\\is-58ELF.tmp\\_isetup\\_setup64.tmp\"\n \"scriptinterpreter.tmp\" created file \"%TEMP%\\is-58ELF.tmp\\uninstall.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"uninstall.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"scriptinterpreter.tmp\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"_setup64.tmp\" as clean (type is \"PE32+ executable (console) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"scriptinterpreter.tmp\" with commandline \"/SL5=\"$201E2\n569884\n191488\nC:\\scriptinterpreter.exe\"\" (UID: 00012796-00000448)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 8E:EF:B9:36:DF:F3:2F:DC:06:21:F9:31:22:EE:F5:2F:D3:E8:6B:18; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 92:C1:58:8E:85:AF:22:01:CE:79:15:E8:53:8B:49:2F:60:5B:80:C6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 61:4D:27:1D:91:02:E3:01:69:82:24:87:FD:E5:DE:00:A3:52:B0:1D; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 19:A0:9B:5A:36:F4:DD:99:72:7D:F7:83:C1:7A:51:23:1A:56:C1:17; see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00012796-00000448-4992-891-008F23F0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"uninstall.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"Setup Log 2018-03-12 #001.txt\" has type \"UTF-8 Unicode (with BOM) text with CRLF CR LF line terminators\"\n \"scriptinterpreter.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"_setup64.tmp\" has type \"PE32+ executable (console) x86-64 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$22","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$23","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"scriptinterpreter.tmp\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"scriptinterpreter.exe.bin\" was detected as \"Borland Delphi 4.0\"\n \"uninstall.dll\" was detected as \"Borland Delphi 4.0\"\n \"scriptinterpreter.tmp\" was detected as \"Borland Delphi 4.0\"\n \"_setup64.tmp\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"SizeofResource@KERNEL32.DLL at 00012283-00004176-63193-125-00966854\n LockResource@KERNEL32.DLL at 00012283-00004176-63193-123-009667FC\n LoadResource@KERNEL32.DLL at 00012283-00004176-63193-124-009667F4\n FindResourceW@KERNEL32.DLL at 00012283-00004176-63193-126-00966688\n FindResourceW@KERNEL32.DLL at 00012796-00000448-4992-1157-008494E8\n SizeofResource@KERNEL32.DLL at 00012796-00000448-4992-1153-0084981C\n LoadResource@KERNEL32.DLL at 00012796-00000448-4992-1155-00849744\n LockResource@KERNEL32.DLL at 00012796-00000448-4992-1152-0084975C\n FindResourceW@KERNEL32.DLL at 00012796-00000448-4992-1156-008494E0\n FindResourceW@kernel32.dll at 60191-2498-00408434\n LockResource@kernel32.dll at 60191-2496-004085F0\n SizeofResource@kernel32.dll at 60191-2733-00408658\n FindResourceW@kernel32.dll at 60191-2735-0040843C\n LoadResource@kernel32.dll at 60191-2497-004085E8\n FreeResource@kernel32.dll at 60191-6340-00408494\n FreeResource@kernel32.dll at 6205-9962-00409548","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"uninstall.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"scriptinterpreter.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"_setup64.tmp\" has type \"PE32+ executable (console) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@user32.dll at 60191-3505-00408AF8\n GetKeyboardState@user32.dll at 6205-5692-00409D4C","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\scriptinterpreter.exe\" marked \"%TEMP%\\is-96JA5.tmp\\scriptinterpreter.tmp\" for deletion\n \"C:\\scriptinterpreter.exe\" marked \"%TEMP%\\is-96JA5.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\is-96JA5.tmp\\scriptinterpreter.tmp\" with delete access\n \"\" opened \"%TEMP%\\is-96JA5.tmp\" with delete access\n \"scriptinterpreter.tmp\" opened \"%TEMP%\\is-58ELF.tmp\\uninstall.dll\" with delete access\n \"scriptinterpreter.tmp\" opened \"%TEMP%\\is-58ELF.tmp\\_isetup\\_setup64.tmp\" with delete access\n \"scriptinterpreter.tmp\" opened \"%TEMP%\\is-58ELF.tmp\\_isetup\" with delete access\n \"scriptinterpreter.tmp\" opened \"%TEMP%\\is-58ELF.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@advapi32.dll at 6205-6484-00409408","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"uninstall.dll\" claimed CRC 747541 while the actual is CRC 1197474\n \"scriptinterpreter.tmp\" claimed CRC 1377646 while the actual is CRC 747541\n \"_setup64.tmp\" claimed CRC 11292 while the actual is CRC 1377646","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n GetModuleFileNameW\n GetVersionExW\n VirtualProtect\n GetFileAttributesW\n GetFileSize\n LockResource\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n LoadLibraryW\n WriteFile\n GetStartupInfoA\n FindFirstFileW\n GetModuleHandleW\n FindResourceW\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n VirtualAlloc\n CreateThread\n ExitThread\n SetWindowsHookExW\n GetLastActivePopup\n FindWindowExW\n FindWindowW\n GetWindowThreadProcessId\n RegCreateKeyExW\n RegDeleteKeyW\n SetSecurityDescriptorDacl\n GetUserNameW\n RegEnumKeyExW\n RegDeleteValueW\n GetDriveTypeW\n DeviceIoControl\n CopyFileW\n TerminateProcess\n OpenProcess\n GetComputerNameW\n FindNextFileW\n ShellExecuteW\n ShellExecuteExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"scriptinterpreter.tmp\" wrote bytes \"f811fb752014fb750c11fb75f516fb75a911fb758548fb75b934fb75a934fb756834fb7500000000a56b1276e4851276e04d12769cc01276a3bf127692ae12760c7d127600000000\" to virtual address \"0x73731000\" (part of module \"MSIMG32.DLL\")\n \"scriptinterpreter.tmp\" wrote bytes \"711146017a3b4501ab8b02007f950200fc8c0200729602006cc805001ecd42017d264201\" to virtual address \"0x75D007E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"scriptinterpreter.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00012796-00000448-4992-1652-008494A0\n DeviceIoControl@kernel32.dll at 6205-3130-004094A0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1500 bytes to a remote process \"%TEMP%\\is-96JA5.tmp\\scriptinterpreter.tmp\" (Handle: 200)\n \"\" wrote 4 bytes to a remote process \"%TEMP%\\is-96JA5.tmp\\scriptinterpreter.tmp\" (Handle: 200)\n \"\" wrote 8 bytes to a remote process \"%TEMP%\\is-96JA5.tmp\\scriptinterpreter.tmp\" (Handle: 200)\n \"\" wrote 32 bytes to a remote process \"%TEMP%\\is-96JA5.tmp\\scriptinterpreter.tmp\" (Handle: 200)\n \"\" wrote 52 bytes to a remote process \"%TEMP%\\is-96JA5.tmp\\scriptinterpreter.tmp\" (Handle: 200)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@user32.dll at 59004-1990-004068B4\n ExitWindowsEx@USER32.DLL at 00012283-00004176-63193-988-009668B2\n ExitWindowsEx@USER32.DLL at 00012796-00000448-4992-161-00849C94","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00012796-00000448-4992-742-00849BCC","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":40,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":16,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5aa5f8937ca3e1372326c147","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":75,"contacted_countries":["EU"],"submit_name":"scriptinterpreter.exe","analysis_start_time":"2018-03-12T04:50:44+00:00","indicators_count":{"informative":22,"suspicious":14,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"92.122.122.146","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}],"processes":[{"pid":4176,"ppid":0,"name":"scriptinterpreter.exe","command_line":"","sha256":"93e11f10ae560d30da40f2215914cd7c5dc87c6767f8b2e5e3f7cdc8ed94046e","normalized_path":"C:\\scriptinterpreter.exe","uid":"00012283-00004176","icon":"$24"},{"pid":448,"ppid":4176,"name":"scriptinterpreter.tmp","command_line":"/SL5=\"$201E2,569884,191488,C:\\scriptinterpreter.exe\"","sha256":"5ff68afc8722c6cbf9989ae2d8491ca8e20c006e3e675905bc92f3c157340a63","normalized_path":"%TEMP%\\is-96JA5.tmp\\scriptinterpreter.tmp","parent_uid":"00012283-00004176","uid":"00012796-00000448"}],"all_imported_dlls":["netmsg.dll","sechost.dll","sspicli.dll","cryptbase.dll","mpr.dll","RstrtMgr.dll","shell32.dll","msimg32.dll","version.dll","comdlg32.dll","shfolder.dll","ncrypt.dll","msasn1.dll","dwmapi.dll","bcrypt.dll","imageres.dll","wow64win.dll","oleaut32.dll","bcryptprimitives.dll","msctf.dll","wow64.dll","kernel32.dll","user32.dll","KernelBase.dll","comctl32.dll","ntdll.dll","usp10.dll","uxtheme.dll","clbcatq.dll","rpcrt4.dll","ole32.dll","msvcrt.dll","gdi32.dll","lpk.dll","shlwapi.dll","imm32.dll","apphelp.dll","wow64cpu.dll","advapi32.dll","profapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_setup64.tmp","sha256":"388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"name":"uninstall.dll","sha256":"5091cd5eef67f8f4cf9ae53b52160d6bedf7245c580d8a231595ba39e55ffdb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"name":"scriptinterpreter.tmp","sha256":"5ff68afc8722c6cbf9989ae2d8491ca8e20c006e3e675905bc92f3c157340a63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"name":"Setup Log 2018-03-12 #001.txt","sha256":"7471191f7edf4289667cb1da34896a4ad5deae3fce4e5c59bde1d138832a759a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]}],"files_written":[{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%WINDIR%\\syswow64\\en\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%WINDIR%\\SysWOW64\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"C:\\scriptinterpreter.exe","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%TEMP%\\Setup Log 2018-03-12 #001.txt","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5aa5f8937ca3e1372326c147"}]}]}},"report_ids":{"sandbox_job_ids":["5aa5f8937ca3e1372326c147"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Suspicious Sample 93e11f10ae56… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 93e11f10ae56…. Threat score 75/100. 0/28 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/93e11f10ae560d30da40f2215914cd7c5dc87c6767f8b2e5e3f7cdc8ed94046e"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 93e11f10ae56… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 93e11f10ae56…. Threat score 75/100. 0/28 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/93e11f10ae560d30da40f2215914cd7c5dc87c6767f8b2e5e3f7cdc8ed94046e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 93e11f10ae56… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 93e11f10ae56…. Threat score 75/100. 0/28 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L25","11",{}]]