24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Adware.Midie.Generic Sample 94189e4d1e03… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 94189e4d1e03…. Malware family: Adware.Midie.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff","keywords":["Malicious","Adware.Midie.Generic","malware analysis","sandbox report","threat intelligence","94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff"],"about":{"@type":"SoftwareApplication","name":"Build3.exe","applicationCategory":["peexe","executable"],"identifier":"94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Adware.Midie.Generic","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T10cd,Assembly shows XOR instruction xor edi 088DA199h in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor ebx 0E0B6E2Fh in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor ecx 7CF8F836h in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor esi 9DFF2892h in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor ecx ebp in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor edi dword ptr [ecx+esi*4+00000638h] in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor edi ebx in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor esi dword ptr [ecx+eax*4-00000D50h] in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor esi edi in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor ebx FFFFFFFEh in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor eax dword ptr [ecx+00000634h] in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor eax edx in Stream UID: 24081-1-0040B970 Assembly shows XOR instruction xor esi 0000D800h in Stream UID: 24081-334-00441800 Assembly shows XOR instruction xor eax 000000C0h in Stream UID: 24081-334-00441800 Assembly shows XOR instruction xor ecx FFFFFFFEh in Stream UID: 24081-625-00427940 Assembly shows XOR instruction xor eax 04h in Stream UID: 24081-1519-00438E93 Assembly shows XOR instruction xor edx eax in Stream UID: 24081-1532-00439DD7 Assembly shows XOR instruction xor edx 8E8C232Eh in Stream UID: 24081-1556-0043CF12 Assembly shows XOR instruction xor edi ebx in Stream UID: 24081-1556-0043CF12 Assembly shows XOR instruction xor edi eax in Stream UID: 24081-1565-0043DB1B Assembly shows XOR instruction xor ebx dword ptr [esi+000001A4h] in Stream UID: 24081-1565-0043DB1B Assembly shows XOR instruction xor edx 31h in Stream UID: 24081-1578-0043F0DA Assembly shows XOR instruction xor edx esi in Stream UID: 24081-1578-0043F0DA Assembly shows XOR instruction xor eax 31h in Stream UID: 24081-1582-0043F7AC Assembly shows XOR instruction xor esi FFFFFFFFh in Stream UID: 24081-1582-0043F7AC Assembly shows XOR instruction xor edi FFFFFFFFh in Stream UID: 24081-1582-0043F7AC Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 24081-1582-0043F7AC Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 24081-1582-0043F7AC Assembly shows XOR instruction xor edx edi in Stream UID: 24081-1582-0043F7AC Assembly shows XOR instruction xor esi 0000D800h in Stream UID: 00000000-00007280-24908-255-00181800 Assembly shows XOR instruction xor eax 000000C0h in Stream UID: 00000000-00007280-24908-255-00181800 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007280-24908-1233-0014BA50 Assembly shows XOR instruction xor edi 088DA199h in Stream UID: 00000000-00007280-24908-1235-0014B970 Assembly shows XOR instruction xor ebx 0E0B6E2Fh in Stream UID: 00000000-00007280-24908-1235-0014B970 Assembly shows XOR instruction xor ecx 7CF8F836h in Stream UID: 00000000-00007280-24908-1235-0014B970 Assembly shows XOR instruction xor esi 9DFF2892h in Stream UID: 00000000-00007280-24908-1235-0014B970 Assembly shows XOR instruction xor eax 04h in Stream UID: 00000000-00007280-24908-1788-00178E93 Assembly shows XOR instruction xor edi eax in Stream UID: 00000000-00007280-24908-1834-0017DB1B Assembly shows XOR instruction xor ebx dword ptr [esi+000001A4h] in Stream UID: 00000000-00007280-24908-1834-0017DB1B Assembly shows XOR instruction xor edx 31h in Stream UID: 00000000-00007280-24908-1847-0017F0DA Assembly shows XOR instruction xor edx esi in Stream UID: 00000000-00007280-24908-1847-0017F0DA Assembly shows XOR instruction xor eax 31h in Stream UID: 00000000-00007280-24908-1851-0017F7AC Assembly shows XOR instruction xor esi FFFFFFFFh in Stream UID: 00000000-00007280-24908-1851-0017F7AC Assembly shows XOR instruction xor edi FFFFFFFFh in Stream UID: 00000000-00007280-24908-1851-0017F7AC Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 00000000-00007280-24908-1851-0017F7AC Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 00000000-00007280-24908-1851-0017F7AC Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00007280-24908-1851-0017F7AC26:T4b2,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff.bin") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff.bin") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff.bin") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff.bin") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007280.00000000.212077.0018D000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007280.00000000.212077.0018D000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00007280.00000000.212077.0018D000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007280.00000000.212077.0018D000.00000002.mdmp")27:T13c6,"" (Indicator: "GetDC"; Source: "00000000-00007280.00000000.212077.028A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007280.00000000.212077.028A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007280.00000000.212077.028A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007280.00000000.212077.028A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007280.00000000.212077.028A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007280.00000000.212077.028A0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007280.00000000.212077.028A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007280.00000000.212077.028A0000.00000004.mdmp")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790778147531,"unified_at":"2026-09-30T14:22:27.531Z","metadata":{"hashes":{"sha256":"94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff","sha1":"e799cc0768b8a355084871eb4b4aaf840c26667d","md5":"4db00b89de7e7c5721c59c50531b5d38","sha512":"ee80c8b1f1ac575f0b5f8ae2bee0b4e9c6f70ac6044e4be3285a129e93d74c2b06a2c66860aff725c0e13280b0b744558dc71aff525b514aa46b95ea59a037d4","ssdeep":"6144:XvgEeOcmwvEL7fF1jTA659HSC8AVtZ5XlOHaoIhEFydyt:/8OcZ07bf0OtDlOHaoIndyt","ssdeep_chunks":["6144:XvgEeOc","6144:vgEeOcm","6144:gEeOcmw","6144:EeOcmwv","6144:eOcmwvE","6144:OcmwvEL","6144:cmwvEL7","6144:mwvEL7f","6144:wvEL7fF","6144:vEL7fF1","6144:EL7fF1j","6144:L7fF1jT","6144:7fF1jTA","6144:fF1jTA6","6144:F1jTA65","6144:1jTA659","6144:jTA659H","6144:TA659HS","6144:A659HSC","6144:659HSC8","6144:59HSC8A","6144:9HSC8AV","6144:HSC8AVt","6144:SC8AVtZ","6144:C8AVtZ5","6144:8AVtZ5X","6144:AVtZ5Xl","6144:VtZ5XlO","6144:tZ5XlOH","6144:Z5XlOHa","6144:5XlOHao","6144:XlOHaoI","6144:lOHaoIh","6144:OHaoIhE","6144:HaoIhEF","6144:aoIhEFy","6144:oIhEFyd","6144:IhEFydy","6144:hEFydyt","12288:XvgEeOc","12288:vgEeOcm","12288:gEeOcmw","12288:EeOcmwv","12288:eOcmwvE","12288:OcmwvEL","12288:cmwvEL7","12288:mwvEL7f","12288:wvEL7fF","12288:vEL7fF1","12288:EL7fF1j","12288:L7fF1jT","12288:7fF1jTA","12288:fF1jTA6","12288:F1jTA65","12288:1jTA659","12288:jTA659H","12288:TA659HS","12288:A659HSC","12288:659HSC8","12288:59HSC8A","12288:9HSC8AV","12288:HSC8AVt","12288:SC8AVtZ","12288:C8AVtZ5","12288:8AVtZ5X","12288:AVtZ5Xl","12288:VtZ5XlO","12288:tZ5XlOH","12288:Z5XlOHa","12288:5XlOHao","12288:XlOHaoI","12288:lOHaoIh","12288:OHaoIhE","12288:HaoIhEF","12288:aoIhEFy","12288:oIhEFyd","12288:IhEFydy","12288:hEFydyt","6144:/8OcZ07","6144:8OcZ07b","6144:OcZ07bf","6144:cZ07bf0","6144:Z07bf0O","6144:07bf0Ot","6144:7bf0OtD","6144:bf0OtDl","6144:f0OtDlO","6144:0OtDlOH","6144:OtDlOHa","6144:tDlOHao","6144:DlOHaoI","6144:lOHaoIn","6144:OHaoInd","6144:HaoIndy","6144:aoIndyt"],"imphash":"723e777b1dee1682594ed1ce566ddb93"},"file_info":{"file_name":"Build3.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":345600,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1777147771000,"last_seen":1777147777000,"last_multi_scan":1777147777000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":21},"sandbox_signatures":{"informative_count":42,"suspicious_count":5,"malicious_count":3,"total":50},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Infostealer/Win.LummaC2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.Lumma","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Adware.Midie.66730","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Adware.Midie.66730 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Spy.LummaStealer.T trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/LummaStealer.fj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 005cdd811 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Suspicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Lumma-P","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Lumma!4DB00B89DE7E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/LummaStealer.I.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusT.FSNA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Adware.Midie.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to query volume/memory size (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to read clipboard data"},{"type":"suspicious","value":"Contains ability to open the clipboard"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007280.00000000.212077.0018D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007280.00000000.212077.028A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007280.00000000.212077.028A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ed1f8077124998290968d1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"