26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Lethic.Generic Sample 98700dbf8aab… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample 98700dbf8aab…. Malware family: Trojan.Lethic.Generic. Threat score 86/100. 20/28 AV engines flagged this file. 10 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/98700dbf8aab16f57032eb5b49c8c0443d31d6f74eba0bcfcf7b458a740dc03c","keywords":["Malicious","Trojan.Lethic.Generic","malware analysis","sandbox report","threat intelligence","98700dbf8aab16f57032eb5b49c8c0443d31d6f74eba0bcfcf7b458a740dc03c"],"about":{"@type":"SoftwareApplication","name":"76j5h4g(1).exe","applicationCategory":["peexe","executable"],"identifier":"98700dbf8aab16f57032eb5b49c8c0443d31d6f74eba0bcfcf7b458a740dc03c","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"Trojan.Lethic.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T47d,"" created file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" created file "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Cookies" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\History" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" created file "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" created file "C:\Windows\system32\rsaenh.dll" "" created file "C:\Windows\system32\en-US\WINHTTP.dll.mui" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S9Y0GKU4\89_108_71_148[1].txt" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QA0UPEJW\89_108_71_148[1].txt"28:Tb65,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")29:T512,"Explorer.EXE" wrote bytes "B8" to virtual address "0x10000010" "Explorer.EXE" wrote bytes "40" to virtual address "0x10000018" "Explorer.EXE" wrote bytes "AB" to virtual address "0x10059CB0" "Explorer.EXE" wrote bytes "CE" to virtual address "0x10059CB1" "Explorer.EXE" wrote bytes "85" to virtual address "0x10059CB2" "Explorer.EXE" wrote bytes "CD" to virtual address "0x10059CAD" "Explorer.EXE" wrote bytes "90" to virtual address "0x10000002" "Explorer.EXE" wrote bytes "28" to virtual address "0x10059CAC" "Explorer.EXE" wrote bytes "AE" to virtual address "0x10059CAF" "Explorer.EXE" wrote bytes "C2" to virtual address "0x10059CAE" "Explorer.EXE" wrote bytes "5A" to virtual address "0x10000001" "Explorer.EXE" wrote bytes "57" to virtual address "0x10059CAB" "Explorer.EXE" wrote bytes "03" to virtual address "0x10000004" "Explorer.EXE" wrote bytes "E8" to virtual address "0x10059CAA" "Explorer.EXE" wrote bytes "A7" to virtual address "0x10059BDE" "Explorer.EXE" wrote bytes "04" to virtual address "0x10000008" "Explorer.EXE" wrote bytes "FF" to virtual address "0x1000000C" "Explorer.EXE" wrote bytes "FF" to virtual address "0x1000000D" "Explorer.EXE" wrote bytes "D0" to virtual address "0x1000003C" "Explorer.EXE" wrote bytes "92" to virtual address "0x10059C81"2a:T8f9,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")2b:T554,"" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")2c:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=2d:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"98700dbf8aab16f57032eb5b49c8c0443d31d6f74eba0bcfcf7b458a740dc03c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":86,"unified_at_epoch_ms":1790264498819,"unified_at":"2026-09-24T15:41:38.819Z","metadata":{"hashes":{"sha256":"98700dbf8aab16f57032eb5b49c8c0443d31d6f74eba0bcfcf7b458a740dc03c","sha1":"5dc9b0739ee46c1c31608e1bdb61d769d20830d0","md5":"37f025e70ee90e40589e7a3fd763817c","sha512":"9929960ed112549d5d445768ff565932e73489a738b0588c4c628958c30fbba9cd13cf7fa867675dce4be0e2cc7d7664d80bcad362c8f9c77e823e1812a64959","ssdeep":"6144:XVOANvx3ttjcSknXSXE3L5GsYa+T9rKYVLBmlAD7:XVOA3LjcSknCXOalLB0Y","ssdeep_chunks":["6144:XVOANvx","6144:VOANvx3","6144:OANvx3t","6144:ANvx3tt","6144:Nvx3ttj","6144:vx3ttjc","6144:x3ttjcS","6144:3ttjcSk","6144:ttjcSkn","6144:tjcSknX","6144:jcSknXS","6144:cSknXSX","6144:SknXSXE","6144:knXSXE3","6144:nXSXE3L","6144:XSXE3L5","6144:SXE3L5G","6144:XE3L5Gs","6144:E3L5GsY","6144:3L5GsYa","6144:L5GsYa+","6144:5GsYa+T","6144:GsYa+T9","6144:sYa+T9r","6144:Ya+T9rK","6144:a+T9rKY","6144:+T9rKYV","6144:T9rKYVL","6144:9rKYVLB","6144:rKYVLBm","6144:KYVLBml","6144:YVLBmlA","6144:VLBmlAD","6144:LBmlAD7","12288:XVOANvx","12288:VOANvx3","12288:OANvx3t","12288:ANvx3tt","12288:Nvx3ttj","12288:vx3ttjc","12288:x3ttjcS","12288:3ttjcSk","12288:ttjcSkn","12288:tjcSknX","12288:jcSknXS","12288:cSknXSX","12288:SknXSXE","12288:knXSXE3","12288:nXSXE3L","12288:XSXE3L5","12288:SXE3L5G","12288:XE3L5Gs","12288:E3L5GsY","12288:3L5GsYa","12288:L5GsYa+","12288:5GsYa+T","12288:GsYa+T9","12288:sYa+T9r","12288:Ya+T9rK","12288:a+T9rKY","12288:+T9rKYV","12288:T9rKYVL","12288:9rKYVLB","12288:rKYVLBm","12288:KYVLBml","12288:YVLBmlA","12288:VLBmlAD","12288:LBmlAD7","6144:XVOA3Lj","6144:VOA3Ljc","6144:OA3LjcS","6144:A3LjcSk","6144:3LjcSkn","6144:LjcSknC","6144:jcSknCX","6144:cSknCXO","6144:SknCXOa","6144:knCXOal","6144:nCXOalL","6144:CXOalLB","6144:XOalLB0","6144:OalLB0Y"],"imphash":"b740ae292c1172ab56982e71734b07f7"},"file_info":{"file_name":"76j5h4g(1).exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":336384,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297090000,"last_seen":1676509513000,"last_multi_scan":1676509513000}},"detections":{"summary":{"verdict":"malicious","score":86,"tags":null},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":21,"malicious_count":10,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.NgrBot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1238159","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Lethic.Gen.9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Agent.XL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Lethic.Gen.9 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.EFXN trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055dd191 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt.eaa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.dyxmoz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_HPEPING.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_HPEPING.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zyx.AQI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanSpy.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.822057","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Lethic.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00143156-00002952-46634-319-004165A0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00143156-00002952-46634-62-004163F9\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00143156-00002952-46634-345-004165E7\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00143156-00002952-46634-289-00422C1F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00143156-00002952-51984-62-004163F9\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00143156-00002952-51984-345-004165E7\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00143156-00002952-51984-289-00422C1F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00143156-00002952-51984-319-004165A0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"157.252.245.32:2448\"\n \"89.32.145.12:8443\"\n \"89.108.71.148:8843\"\n \"91.212.89.239:443\"\n \"89.189.174.19:444\"\n \"122.151.73.216:443\"\n \"37.128.132.96:443\"\n \"195.187.111.11:444\"\n \"37.99.146.27:443\"\n \"77.221.140.99:443\"\n \"195.251.145.79:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6A73.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6A74.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6AD3.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6AD4.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab815A.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar815B.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\d22f2a8e605f24d04848ee2d4ce55a38\"\n \"IESQMMUTEX_0_208\"\n \"Global\\7f47a3d169175a735ce35ca2697548a0\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"USER32.DLL\" at base 75A60000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\UXTHEME.DLL\" at base 73DB0000\n \"\" loaded module \"SHELL32.DLL\" at base 75B30000\n \"\" loaded module \"NTDLL.DLL\" at base 76EE0000\n \"\" loaded module \"ADVAPI32.DLL\" at base 76C60000\n \"\" loaded module \"SHLWAPI.DLL\" at base 76B30000\n \"\" loaded module \"WININET.DLL\" at base 768D0000\n \"\" loaded module \"COMCTL32.DLL\" at base 73EF0000\n \"\" loaded module \"KERNEL32.DLL\" at base 76DA0000\n \"\" loaded module \"OLE32.DLL\" at base 769D0000\n \"\" loaded module \"API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL\" at base 77040000\n \"\" loaded module \"PROFAPI.DLL\" at base 75030000\n \"\" loaded module \"NTMARTA.DLL\" at base 745C0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"CommandLineToArgvW@SHELL32.dll\"\n \"RtlFillMemory@ntdll.dll\"\n \"RegOpenKeyExA@ADVAPI32.dll\"\n \"RegQueryValueExA@ADVAPI32.dll\"\n \"OpenProcessToken@ADVAPI32.dll\"\n \"GetTokenInformation@ADVAPI32.dll\"\n \"AllocateAndInitializeSid@ADVAPI32.dll\"\n \"EqualSid@ADVAPI32.dll\"\n \"FreeSid@ADVAPI32.dll\"\n \"RtlQueryElevationFlags@ntdll.dll\"\n \"GetSidSubAuthorityCount@ADVAPI32.dll\"\n \"GetSidSubAuthority@ADVAPI32.dll\"\n \"RegCloseKey@ADVAPI32.dll\"\n \"wvnsprintfW@SHLWAPI.dll\"\n \"InternetOpenA@wininet.dll\"\n \"EventActivityIdControl@ADVAPI32.dll\"\n \"EventWriteTransfer@ADVAPI32.dll\"\n \"SHGetFolderPathW@SHELL32.dll\"\n \"OpenThreadToken@ADVAPI32.dll\"\n \"ConvertSidToStringSidW@sechost.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Explorer.EXE\" (UID: 00240078-00001624)\n Spawned process \"taskhost.exe\" (UID: 00258640-00001412)\n Spawned process \"taskhost.exe\" (UID: 00260343-00002968)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00143156-00002952-76F4228D-208996\n LookupAccountNameLocalW@SECHOST.DLL at 00143156-00002952-76F4228D-234837","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Cab6A73.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar6A74.tmp\" has type \"data\"\n \"Cab6AD3.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar6AD4.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"Cab815A.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar815B.tmp\" has type \"data\"\n \"89_108_71_148[1].txt\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00143156-00002952-46634-16-0041A79F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00143156-00002952-46634-17-0041605A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00143156-00002952-46634-434-0042741A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00143156-00002952-46634-774-0042259C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00143156-00002952-51984-16-0041A79F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00143156-00002952-51984-17-0041605A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00143156-00002952-51984-434-0042741A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00143156-00002952-51984-774-0042259C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00143156-00002952-76F4228D-206192\n RasRpcGetVersion@RASMAN.DLL at 00143156-00002952-76F4228D-208015","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00143156-00002952-76F4228D-242104","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.DLL at 00143156-00002952-76F4228D-206092\n SizeofResource@KERNEL32.DLL at 00143156-00002952-76F4228D-206093\n LoadResource@KERNEL32.DLL at 00143156-00002952-76F4228D-206094\n FindResourceA@KERNEL32.DLL at 00143156-00002952-76F4228D-206096","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00143156-00002952-76F4228D-206900\n RasPortListen@RASMAN.DLL at 00143156-00002952-76F4228D-207953","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00143156-00002952-76F4228D-240036","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\76j5h4g_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6A73.tmp\" for deletion\n \"Z:\\76j5h4g_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6A74.tmp\" for deletion\n \"Z:\\76j5h4g_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6AD3.tmp\" for deletion\n \"Z:\\76j5h4g_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6AD4.tmp\" for deletion\n \"Z:\\76j5h4g_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab815A.tmp\" for deletion\n \"Z:\\76j5h4g_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar815B.tmp\" for deletion\n \"Z:\\76j5h4g_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\89_108_71_148[1].txt\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6A73.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6A74.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6AD3.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6AD4.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab815A.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar815B.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\89_108_71_148[1].txt\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"ShellExecuteA\n RegOpenKeyA\n RegCloseKey\n WriteFile\n Sleep\n VirtualAlloc\n TerminateProcess\n UnhandledExceptionFilter\n IsDebuggerPresent\n CreateFileA\n GetFileAttributesA\n FindFirstFileA\n GetTempFileNameA\n GetTickCount\n LockResource\n FindResourceA\n GetVersionExA\n GetModuleFileNameA\n CreateProcessA\n GetProcAddress\n GetModuleHandleA\n GetModuleFileNameW\n LoadLibraryA\n VirtualAllocEx\n OpenProcess\n GetCommandLineA\n GetStartupInfoA\n GetModuleHandleW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/53 Antivirus vendors marked sample as malicious (9% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00005012 bytes of memory in \"explorer.exe\" (Protection: \"execute/read/write\")\n \"\" allocated 00339968 bytes of memory in \"explorer.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00240078-00001624)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 339968 bytes to a foreign process \"explorer.exe\" (PID: 00001624)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 11 (or more) hosts in at least 9 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"77.221.140.99\" (ASN: 30968, Owner: Infobox.ru Autonomous System): ...\nURL: http://77.221.140.99/ (AV positives: 2/66 scanned on 11/23/2015 00:00:39)\n URL: http://77.221.140.99:443/ (AV positives: 2/66 scanned on 11/17/2015 08:34:45)\n URL: http://www.psylive.ru/?mod=articles&gl=7&id=15 (AV positives: 1/63 scanned on 07/22/2015 03:16:09)\n URL: http://lenta2012.ru/ (AV positives: 1/63 scanned on 07/01/2015 00:08:24)\n URL: http://starter2000.ru/ (AV positives: 1/62 scanned on 02/10/2015 03:22:18)\n File SHA256: f1cd3942369d778b5bdc503d81b5f3d871eb367a2e56097df67e4df8e85284dd (AV positives: 15/51 scanned on 11/22/2014 09:42:33)\n File SHA256: 2dec947c4a9ddff0a7a12017b7a8b96ed0942f2950ba8648f97321a2131e4171 (AV positives: 1/49 scanned on 11/18/2014 04:32:14)\n File SHA256: 8eb42623ad4af7b93decf41a9fcee2bf35fcdbad7bf9167b1ead8efde41b3d0e (AV positives: 28/49 scanned on 03/01/2014 06:16:27)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 157.252.245.32 on port 2448\n TCP traffic to 89.32.145.12 on port 8443\n TCP traffic to 89.108.71.148 on port 8843","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")\n \"Explorer.EXE\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$2a","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00143156-00002952-76F4228D-225153\n NtQueryInformationProcess@NTDLL.DLL at 00143156-00002952-76F4228D-240231\n NtQueryVirtualMemory@NTDLL.DLL at 00143156-00002952-76F4228D-242102","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00154000-00002484-7746FDA0-182905","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$2b","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Contains ability to listen for incoming connections"},{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":50,"imported_dlls_count":171,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":35,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":11,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"565315600e316d544b544f46","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":53,"malware_family":"Agent.XL.gen","submit_name":"76j5h4g.exe","analysis_start_time":"2015-11-23T07:32:30+00:00","indicators_count":{"informative":6,"suspicious":14,"malicious":2},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"565309d00e316da55a4bdd7a","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":86,"malware_family":"Agent.XL.gen","contacted_countries":["AUS","GBR","GRC","POL","ROU","RUS","SAU","USA","UZB"],"submit_name":"76j5h4g(1).exe","analysis_start_time":"2015-11-23T06:43:12+00:00","indicators_count":{"informative":10,"suspicious":30,"malicious":12},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"157.252.245.32","port":2448,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"address":"89.32.145.12","port":8443,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"address":"89.108.71.148","port":8843,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"address":"91.212.89.239","port":443,"protocol":"TCP","country":"Uzbekistan","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"address":"89.189.174.19","port":444,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"address":"122.151.73.216","port":443,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"address":"37.128.132.96","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"address":"195.187.111.11","port":444,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"address":"37.99.146.27","port":443,"protocol":"TCP","country":"Saudi Arabia","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"address":"77.221.140.99","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"address":"195.251.145.79","port":443,"protocol":"TCP","country":"Greece","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}],"processes":[{"pid":2952,"ppid":0,"name":"76j5h4g_1_.exe","command_line":"","normalized_path":"","uid":"00143156-00002952","icon":"$2c"},{"pid":1624,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00240078-00001624","icon":"$2d"},{"pid":1412,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00258640-00001412"},{"pid":2968,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00260343-00002968"}],"all_imported_dlls":["GDI32.dll","msvcrt.dll","ntmarta.dll","PortableDeviceTypes.dll","wkscli.dll","CRYPT32.dll","NLAapi.dll","rasadhlp.dll","authui.dll","provsvc.dll","shdocvw.dll","POWRPROF.dll","hcproviders.dll","imapi2.dll","napinsp.dll","GPAPI.dll","SHLWAPI.dll","ATL.DLL","es.dll","secur32.dll","NSI.dll","SETUPAPI.dll","samcli.dll","netprofm.dll","WinSCard.dll","wininet.dll","AVRT.dll","NetworkExplorer.dll","KERNELBASE.dll","wintrust.dll","USER32.dll","RPCRT4.dll","QAgent.dll","ADVAPI32.dll","OLEACC.dll","XmlLite.dll","IPHLPAPI.DLL","WINTRUST.dll","comctl32.dll","RASAPI32.dll","wwapi.dll","ehSSO.dll","Normaliz.dll","urlmon.dll","pnrpnsp.dll","ntdll.dll","SyncCenter.dll","EXPLORERFRAME.dll","ole32.dll","MSASN1.dll","WLDAP32.dll","SXS.DLL","CRYPTBASE.dll","wship6.dll","schannel.DLL","bcryptprimitives.dll","BatMeter.dll","Secur32.dll","EhStorShell.dll","AUDIOSES.DLL","winrnr.dll","fwpuclnt.dll","CRYPTUI.dll","wevtapi.dll","FXSRESM.DLL","prnfldr.dll","ieframe.dll","WindowsCodecs.dll","kernel32.dll","MsftEdit.dll","npmproxy.dll","SndVolSSO.DLL","MSACM32.dll","taskschd.dll","WINMM.dll","ieproxy.dll","gameux.dll","iertutil.dll","QUtil.dll","WS2_32.dll","USP10.dll","IMM32.DLL","uxtheme.dll","rsaenh.dll","netshell.dll","wer.dll","tiptsf.dll","Wlanapi.dll","framedynos.dll","apphelp.dll","profapi.dll","ncrypt.dll","cryptnet.dll","SspiCli.dll","WSCAPI.dll","msi.dll","rtutils.dll","nlaapi.dll","CLBCatQ.DLL","ksuser.dll","midimap.dll","MSCTF.dll","VERSION.dll","Cabinet.dll","dxp.dll","UIAnimation.dll","hgcpl.dll","pnidui.dll","DEVOBJ.dll","CFGMGR32.dll","shacct.dll","PROPSYS.dll","Actioncenter.dll","actxprxy.dll","msls31.dll","PortableDeviceApi.dll","msiltcfg.dll","DUser.dll","wercplsupport.dll","credssp.dll","WINNSI.DLL","fxsst.dll","wpdshserviceobj.dll","WTSAPI32.dll","sensapi.dll","netutils.dll","IconCodecService.dll","RpcRtRemote.dll","wshtcpip.dll","OLEAUT32.dll","Syncreg.dll","SSPICLI.DLL","FXSAPI.dll","AltTab.dll","srvcli.dll","srchadmin.dll","dwmapi.dll","wscinterop.dll","cscapi.dll","SAMLIB.dll","rasman.dll","sechost.dll","wlanutil.dll","LINKINFO.dll","werconcpl.dll","slc.dll","mswsock.dll","DUI70.dll","gdiplus.dll","SHELL32.dll","USERENV.dll","stobject.dll","HID.DLL","WININET.dll","dnsapi.DLL","ntshrui.dll","PSAPI.DLL","LPK.dll","ws2_32.DLL","iphlpapi.DLL","MMDevApi.dll","wwanapi.dll","IMM32.dll","WINSTA.dll","DEVRTL.dll","WINHTTP.dll","dhcpcsvc6.DLL","dhcpcsvc.DLL","UxTheme.dll","CRYPTSP.dll","pdh.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"94308059B57B3142E455B38A6EB92015","sha256":"1eebbb0aa82da0ae7d4b37c118e50c2fa9a1b22f2b97f3bab2d88a658e30dc1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"89_108_71_148[1].txt","sha256":"f3a58fcaff346839ef2f3ca17152a3e894f6b0fd5eefb7ea9697876c9165b496","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Cab6A73.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Cab6AD3.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Cab815A.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Tar6A74.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Tar6AD4.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Tar815B.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"SCHEDLGU.TXT","sha256":"2b184b82d1c3b5ee5981bddb6be7470a08f6309a5573e6f0fad8321eb07f2806","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"name":"setupact.log","sha256":"66eb51c62e5147e614f00e63293e9cc9e8f3ce0c6fd60eef61a7caab3cdaf992","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\89_108_71_148[1].txt","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\slideshow.ini","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{90128E42-0E24-B3D9-2BAD-078B26C6B7C6}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{90128E42-0E24-B3D9-2BAD-078B26C6B7C6}\\","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{5E559074-8578-F779-5582-D7920AAC24DA}\\SHELLFOLDER\\1D125EDD9C8E14B\\1D125EDD9C8E14B","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\CCLEANER MONITORING\\CCLEANER MONITORING","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"},{"report_type":"sandbox","report_id":"565315600e316d544b544f46"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\d22f2a8e605f24d04848ee2d4ce55a38","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\7f47a3d169175a735ce35ca2697548a0","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\bfa7bf1b118eaec0fdf20a5cd9056ef1","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\368d3a587f861b6d4d4eed85edfd34a9","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\dda43c716b3ae70b7ac29f064b977295","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\592d4e3aaeeb107aec6e282a5362047f","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\eab27dcae5763d369639cfc369bb78e0","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\a362398b23987061baaf1f7cb4963cec","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\e8ba6ae2adc5e5e3c8acf5998726caaa","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\4c1ef191968f3019c45c4679e8d1701c","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\57c199e8b280a81988b99ce7fec157e6","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\81fc32074ed6ac8831f14746cbcb795c","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\9b300795d79c02c0f1aa5c3dc5ffbdda","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\51ce3d43244720623a9dad5a03aefc6a","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\85e8e2d8859ab92189a4119ae795a238","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\dc08c4b07315b25db4ba0befe4e1bb11","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\386051bd15489f093169535ddfb66d6f","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\4a16c9d49d248db2bc6295dbc76446b3","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\d9066deb20b12148d937479591debb50","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\faaedf110199087b66a0f4a7e377da6a","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\2a8de78b8b1e202727274442906da18d","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\41abf283c0b35ac32ad42eac52e7e4b3","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\68244dc766b2930d44a3ab669a50a36b","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\f9f986610a5373ab65300700aba7a384","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\ff01049a37ac2b61176bde26c596fca7","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\2b0c3891537bfe75bb1314f824f35ddc","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\e7d01528d62fc6b7d6a724a260ce403a","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\3cb4330eae0306bdd12d4350189423c9","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\7d0cfa6ca1c04858179eb851e1365af4","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\8ae1fd16c4e886b51c93adb20e304b7a","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\e88fbaeb98dc6b998885105ab8c94c35","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\ac427f2f62bcc1a013a22a064b18cb97","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\ccc9682de0a0e95fa5093d9ed80b6aa5","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\3d0a3f5ae2ec0f96f4bd0e2995280a9d","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\dc407420bbd97c63abf3c484c2798cf2","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\3f63cf824d7a764dd1968cefebb03a2b","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\154f387025f3d9dccfc769555589e034","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]},{"name":"Global\\8609eb4f08ec26b045c3257c87deddf3","sources":[{"report_type":"sandbox","report_id":"565309d00e316da55a4bdd7a"}]}]}},"report_ids":{"sandbox_job_ids":["565309d00e316da55a4bdd7a","565315600e316d544b544f46"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Lethic.Generic Sample 98700dbf8aab… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 98700dbf8aab…. Malware family: Trojan.Lethic.Generic. Threat score 86/100. 20/28 AV engines flagged this file. 10 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/98700dbf8aab16f57032eb5b49c8c0443d31d6f74eba0bcfcf7b458a740dc03c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Lethic.Generic Sample 98700dbf8aab… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 98700dbf8aab…. Malware family: Trojan.Lethic.Generic. Threat score 86/100. 20/28 AV engines flagged this file. 10 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/98700dbf8aab16f57032eb5b49c8c0443d31d6f74eba0bcfcf7b458a740dc03c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Lethic.Generic Sample 98700dbf8aab… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 98700dbf8aab…. Malware family: Trojan.Lethic.Generic. Threat score 86/100. 20/28 AV engines flagged this file. 10 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]