21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T489,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 9a76ac2c8931… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9a76ac2c8931…. Malware family: Trojan.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 12 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9a76ac2c893154592a09a179e5af2c86c8871265d009014bfb5ab25fabdb448a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","9a76ac2c893154592a09a179e5af2c86c8871265d009014bfb5ab25fabdb448a"],"about":{"@type":"SoftwareApplication","name":"msserver.exe","applicationCategory":["peexe","executable"],"identifier":"9a76ac2c893154592a09a179e5af2c86c8871265d009014bfb5ab25fabdb448a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":26},"behavioralIndicators":{"malicious":12,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T4ac,GetProcessHeap@KERNEL32.dll at 329-2276-0043B982 GetProcessHeap@KERNEL32.dll at 329-2287-0043BFF5 GetProcessHeap@KERNEL32.dll at 329-2280-0043B7EF GetProcessHeap@KERNEL32.dll at 329-2274-0043B850 GetProcessHeap@KERNEL32.dll at 329-2279-0043B78E GetProcessHeap@KERNEL32.dll at 329-2278-0043B593 GetProcessHeap@KERNEL32.dll at 329-2275-0043B94E GetProcessHeap@KERNEL32.dll at 329-2288-0043BF5B GetProcessHeap@KERNEL32.dll at 329-2277-0043B8E7 GetProcessHeap@KERNEL32.dll at 329-2273-0043B398 GetProcessHeap@KERNEL32.DLL at 00011809-00005048-10444-768-01247CF0 GetProcessHeap@KERNEL32.DLL at 00011809-00005048-10444-893-0123A937 GetProcessHeap@KERNEL32.DLL at 00011809-00005048-10444-1368-0124B398 GetProcessHeap@KERNEL32.DLL at 00011809-00005048-10444-1374-0124B78E GetProcessHeap@KERNEL32.DLL at 00011809-00005048-10444-1383-0124BF5B GetProcessHeap@KERNEL32.DLL at 00011809-00005048-10444-1369-0124B850 GetProcessHeap@KERNEL32.DLL at 00011809-00005048-10444-1371-0124B982 GetProcessHeap@KERNEL32.DLL at 00011809-00005048-10444-1372-0124B8E7 GetProcessHeap@KERNEL32.DLL at 00011809-00005048-10444-1370-0124B94E GetProcessHeap@KERNEL32.DLL at 00011809-00005048-10444-1375-0124B7EF23:T5ea,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\SysWOW64\rsaenh.dll" "" touched file "C:\Windows\SysWOW64\ntdll.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index256.dat" "" touched file "C:\Windows\assembly\pubpol107.dat"24:T531,RegCreateKeyExW RegCloseKey CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW IcmpSendEcho GetDriveTypeW GetFileAttributesW UnhandledExceptionFilter FindResourceExW DeviceIoControl CopyFileW WriteProcessMemory OutputDebugStringW GetModuleFileNameW IsDebuggerPresent LoadLibraryExW CreateThread ExitThread TerminateProcess GetModuleHandleExW CreateToolhelp32Snapshot LoadLibraryW GetVersionExW LoadLibraryA GetFileSize OpenProcess GetStartupInfoW ReadProcessMemory CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetComputerNameW WriteFile FindNextFileW FindFirstFileW CreateFileW VirtualAllocEx FindResourceW Process32NextW LockResource GetCommandLineW Process32FirstW GetModuleHandleW GetTempPathW CreateProcessW Sleep VirtualAlloc ShellExecuteW ShellExecuteExW SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto25:T4d5,"" wrote 32 bytes to a remote process "C:\msserver.exe" (Handle: 376) "" wrote 52 bytes to a remote process "C:\msserver.exe" (Handle: 376) "" wrote 4 bytes to a remote process "C:\msserver.exe" (Handle: 376) "" wrote 8 bytes to a remote process "C:\msserver.exe" (Handle: 376) "" wrote 294912 bytes to a remote process "C:\msserver.exe" (Handle: 376) "" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 544) "" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 544) "" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 544) "" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 544) "" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 552) "" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 552) "" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 552) "" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 552)26:T68d,NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1135-0127F5D0 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1144-012802AA NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1147-0127F0A1 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1138-0127F425 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1131-0122AC99 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1165-0127FF04 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1133-0122AD5C NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1153-0122B845 NtdllDefWindowProc_W@NTDLL.DLL at 00011809-00005048-10444-1045-012129C2 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1152-0127FF91 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1142-0127ECBC NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1150-0122B7F2 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1140-0127EFA8 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1146-0127FE80 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1141-0127F594 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1176-0127EA4E NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1167-0127F37C NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1175-0127F45A NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1169-0127F3DA NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1168-0127F3AB NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1170-0127F122 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1177-0122AFB4 NtdllDialogWndProc_W@NTDLL.DLL at 00011809-00005048-10444-1172-0127EAA627:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwB///////////////////cAf//////////////////3AH//////////////////9wB/+IiIiIiIj/iIiI////cAf/h3d3d3d4/////////3AH/4d3d3d3eP+IiIj///9wB/+Hd3d3d3j/////////cAf/h3d3d3d4/////////3AH/4d3d3d3eP+IiIj///9wB/+Hd3d3d3j/////////cAf/h3d3d3d4/4iIiP93/3AH/4d3d3d3eP//////d/9wB/+Hd3d3d3j/iIiI/3f/cAf/iHd3d3d4//////93/3AH/4d3d3d3eP+IiIj/d/9wB/+Hd3d3d3j//////2f/cAf/h3d3d3d4/4iIiP9m/3AH/4d3d3d3eP//////Zv9wB/+IiIiIiIj/iIiI/2b/cAf//////////////////3AH//////////////////9wB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"9a76ac2c893154592a09a179e5af2c86c8871265d009014bfb5ab25fabdb448a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790376663511,"unified_at":"2026-09-25T22:51:03.511Z","metadata":{"hashes":{"sha256":"9a76ac2c893154592a09a179e5af2c86c8871265d009014bfb5ab25fabdb448a","sha1":"2257b0dbca51ad18dc1c373b745a5afaa4ca5fd2","md5":"77dfc26b160c4eadaa140cefb25c04ff","sha512":"56e21d266df83af4aedb9e92bb9f1803daa93bab32344ad25433ca31d852f2f5a2521eb877afbc99a02662d8fdf3742364881202c3209caeeab132ab3de4335a","ssdeep":"24576:j4lavt0LkLL9IMixoEgea/TbCS11K2Qf6dB7/B7Jq9MmCS:2kwkn9IMHea/TbCUK2QfC/BdaPCS","ssdeep_chunks":["24576:j4lavt0","24576:4lavt0L","24576:lavt0Lk","24576:avt0LkL","24576:vt0LkLL","24576:t0LkLL9","24576:0LkLL9I","24576:LkLL9IM","24576:kLL9IMi","24576:LL9IMix","24576:L9IMixo","24576:9IMixoE","24576:IMixoEg","24576:MixoEge","24576:ixoEgea","24576:xoEgea/","24576:oEgea/T","24576:Egea/Tb","24576:gea/TbC","24576:ea/TbCS","24576:a/TbCS1","24576:/TbCS11","24576:TbCS11K","24576:bCS11K2","24576:CS11K2Q","24576:S11K2Qf","24576:11K2Qf6","24576:1K2Qf6d","24576:K2Qf6dB","24576:2Qf6dB7","24576:Qf6dB7/","24576:f6dB7/B","24576:6dB7/B7","24576:dB7/B7J","24576:B7/B7Jq","24576:7/B7Jq9","24576:/B7Jq9M","24576:B7Jq9Mm","24576:7Jq9MmC","24576:Jq9MmCS","49152:j4lavt0","49152:4lavt0L","49152:lavt0Lk","49152:avt0LkL","49152:vt0LkLL","49152:t0LkLL9","49152:0LkLL9I","49152:LkLL9IM","49152:kLL9IMi","49152:LL9IMix","49152:L9IMixo","49152:9IMixoE","49152:IMixoEg","49152:MixoEge","49152:ixoEgea","49152:xoEgea/","49152:oEgea/T","49152:Egea/Tb","49152:gea/TbC","49152:ea/TbCS","49152:a/TbCS1","49152:/TbCS11","49152:TbCS11K","49152:bCS11K2","49152:CS11K2Q","49152:S11K2Qf","49152:11K2Qf6","49152:1K2Qf6d","49152:K2Qf6dB","49152:2Qf6dB7","49152:Qf6dB7/","49152:f6dB7/B","49152:6dB7/B7","49152:dB7/B7J","49152:B7/B7Jq","49152:7/B7Jq9","49152:/B7Jq9M","49152:B7Jq9Mm","49152:7Jq9MmC","49152:Jq9MmCS","24576:2kwkn9I","24576:kwkn9IM","24576:wkn9IMH","24576:kn9IMHe","24576:n9IMHea","24576:9IMHea/","24576:IMHea/T","24576:MHea/Tb","24576:Hea/TbC","24576:ea/TbCU","24576:a/TbCUK","24576:/TbCUK2","24576:TbCUK2Q","24576:bCUK2Qf","24576:CUK2QfC","24576:UK2QfC/","24576:K2QfC/B","24576:2QfC/Bd","24576:QfC/Bda","24576:fC/BdaP","24576:C/BdaPC","24576:/BdaPCS"],"imphash":"0e136cae6f625c80ecae333d9e2a37fa"},"file_info":{"file_name":"msserver.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1343488,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1527706264000,"last_seen":1662739568000,"last_multi_scan":1662739568000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["neshta","petya","ransomware"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":25,"suspicious_count":26,"malicious_count":12,"total":63},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Noancooe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1245823","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.30901721","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Agent.AFI.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.30901721 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/NanoCore.K trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Tiny","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005642691 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Androm.pyqy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FLNM!77DFC26B160C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Androm.fcyuki","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dnldr11.BHLE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"malicious","threat_name":"Suspicious:NewThreat.270","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 329-2203-00428E19\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011809-00005048-10444-16-01238E3C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011809-00005048-10444-1298-01238E19","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API MessageBoxW@USER32.DLL at 00011809-00005048-10444-19-012446D0\n Found reference to API GetSystemWow64DirectoryW@KERNEL32.DLL at 00011809-00005048-10444-495-0126EBB9\n Found reference to API Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00011809-00005048-10444-819-01213F32\n Found reference to API Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00011809-00005048-10444-807-01213EC5\n Found reference to API IsWow64Process@KERNEL32.DLL at 00011809-00005048-10444-1211-0122E6E3\n Found reference to API GetNativeSystemInfo@KERNEL32.DLL at 00011809-00005048-10444-1208-0122E6A6","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 329-1839-004486AE\n GetLocalTime@KERNEL32.dll at 329-2652-00450E41\n GetLocalTime@KERNEL32.DLL at 00011809-00005048-10444-422-0122E08F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00011809-00005048-10444-489-012340DA\n GetLocalTime@KERNEL32.DLL at 00011809-00005048-10444-951-012586AE\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00011809-00005048-10444-895-01243B93","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00011809-00005048-10444-433-01242C3C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 329-2110-0041E47B\n GetVersionExW@KERNEL32.DLL at 00011809-00005048-10444-1205-0122E47B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.dll at 329-2617-0044EC11\n GetDiskFreeSpaceExW@KERNEL32.dll at 329-2615-0044EA85\n GetDiskFreeSpaceExW@KERNEL32.dll at 329-2616-0044EB4B","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetLocalTime@KERNEL32.dll directly followed by \"cmp word ptr [esi], 0000h\" and \"je 00448826h\" at 329-1839-004486AE\n Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp word ptr [esi], 0000h\" and \"je 01258826h\" at 00011809-00005048-10444-951-012586AE","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"$22","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO DYNAMIC_DNS Query to *.duckdns. Domain\" (SID: 2022918, Rev: 2, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"secureserver202.duckdns.org\"\n \"apache202.duckdns.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"181.215.247.31:25255\"\n \"185.208.211.142:25255\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"UnregisterHotKey@USER32.dll at 329-1965-004045A7\n RegisterHotKey@USER32.dll at 329-2097-0041CC12\n UnregisterHotKey@USER32.DLL at 00011809-00005048-10444-1060-012145A7\n RegisterHotKey@USER32.DLL at 00011809-00005048-10444-1192-0122CC12","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\autDEDD.tmp\"\n \"\" created file \"%TEMP%\\tmpF38D.tmp\"\n \"\" created file \"%TEMP%\\tmpF498.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\{8f3a5ca1-d535-4a5a-8d23-c2f965ff6162}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"Global\\.net clr networking\"\n \"Global\\{8f3a5ca1-d535-4a5a-8d23-c2f965ff6162}\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\199dd46435d7fdbbe590cccd8c8ae9cb\\mscorlib.ni.dll\" at 72DC0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00012128-00003312)\n Spawned process \"schtasks.exe\" with commandline \"/create /f /tn \"SCSI Service\" /xml \"%TEMP%\\tmpF38D.tmp\"\" (UID: 00012381-00003936)\n Spawned process \"schtasks.exe\" with commandline \"/create /f /tn \"SCSI Service Task\" /xml \"%TEMP%\\tmpF498.tmp\"\" (UID: 00012397-00004876)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00011809-00005048-10444-422-0122E08F","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"tmpF498.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"\n \"autDEDD.tmp\" has type \"data\"\n \"run.dat\" has type \"COM executable for DOS\"\n \"KB_194125.dat\" has type \"data\"\n \"tmpF38D.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$23","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"secureserver202.duckdns.org\"\n Heuristic match: \"apache202.duckdns.org\"\n Pattern match: \"http://schemas.microsoft.com/windows/2004/02/mit/task\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"msserver.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.dll at 329-2853-0045703C","origin":"Hybrid Analysis Technology","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.94005562789","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00011809-00005048-10444-422-0122E08F","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"\" (Thread ID: 5100) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://secureserver202.duckdns.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 329-2536-00447212\n LockResource@KERNEL32.DLL at 00011809-00005048-10444-813-012131F2","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"run.dat\" has type \"COM executable for DOS\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SCSI SERVICE\"; Value: \"%PROGRAMFILES%\\(x86)\\SCSI Service\\scsisv.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"255.255.255.255\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.dll at 329-2774-0045550C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 329-2979-00461AD0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00011809-00005048-10444-229-01256F5B","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.dll at 329-2858-00457294\n OpenClipboard@USER32.dll at 329-2855-00457099","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.dll at 329-2500-004445F9\n GetAsyncKeyState@USER32.dll at 329-2485-00443569\n GetKeyboardState@USER32.dll at 329-2506-004447DE\n GetKeyboardState@USER32.dll at 329-2487-0044388D\n GetKeyboardState@USER32.dll at 329-2488-00444497\n GetKeyboardState@USER32.dll at 329-2504-00444342","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\msserver.exe\" marked \"%TEMP%\\autDEDD.tmp\" for deletion\n \"C:\\msserver.exe\" marked \"%TEMP%\\tmpF38D.tmp\" for deletion\n \"C:\\msserver.exe\" marked \"%TEMP%\\tmpF498.tmp\" for deletion\n \"C:\\msserver.exe\" marked \"C:\\msserver.exe:Zone.Identifier\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\SCSI Service\\scsisv.exe\" with delete access\n \"\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpF38D.tmp\" with delete access\n \"\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpF498.tmp\" with delete access\n \"\" opened \"C:\\msserver.exe:Zone.Identifier\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.dll at 329-2278-0043B593\n SetSecurityDescriptorDacl@ADVAPI32.dll at 329-2273-0043B398\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00011809-00005048-10444-1368-0124B398\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00011809-00005048-10444-1373-0124B593","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to impersonate another user on the local machine","description":"LogonUserW@ADVAPI32.dll at 329-2289-0043BE95\n LogonUserW@ADVAPI32.DLL at 00011809-00005048-10444-1384-0124BE95","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-46","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to lookup privileges","description":"GetSecurityDescriptorDacl@ADVAPI32.dll at 329-2278-0043B593\n GetSecurityDescriptorDacl@ADVAPI32.dll at 329-2273-0043B398\n GetSecurityDescriptorDacl@ADVAPI32.DLL at 00011809-00005048-10444-1368-0124B398\n GetSecurityDescriptorDacl@ADVAPI32.DLL at 00011809-00005048-10444-1373-0124B593","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-43","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Uncategorized Behavior","name":"Contains ability to read the monitor info","description":"GetMonitorInfoW@USER32.dll at 329-3102-0046744C","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-62","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$24","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"c0dfbc771cf9bb77ccf8bb770d64bd7700000000c011d67600000000fc3ed67600000000e013d676000000009457cb7625e0bc77c6e0bc7700000000bc6aca7600000000cf31d676000000009319cb76000000002c32d67600000000\" to virtual address \"0x75601000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"7111d9017a3bd801ab8b02007f950200fc8c0200729602006cc805001ecdd5017d26d501\" to virtual address \"0x75E907E4\" (part of module \"USER32.DLL\")\n \"schtasks.exe\" wrote bytes \"7111d9017a3bd801ab8b02007f950200fc8c0200729602006cc805001ecdd5017d26d501\" to virtual address \"0x75E907E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%PROGRAMFILES%\\(x86)\\SCSI Service\\scsisv.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"\" opened \"C:\\msserver.exe:Zone.Identifier\" with delete access","origin":"API Call","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/66 Antivirus vendors marked sample as malicious (24% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/66 Antivirus vendors marked sample as malicious (24% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 329-2535-0044713C\n DeviceIoControl@KERNEL32.dll at 329-2534-004470AE\n DeviceIoControl@KERNEL32.dll at 329-2533-0044702F\n DeviceIoControl@KERNEL32.dll at 329-2597-0044D950","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"16/66 Antivirus vendors marked spawned process \"\" (PID: 3312) as malicious (classified as \"AutoIt.DR.gen\" with 24% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\\Catalog_Entries\"\n \"\" allocated memory in \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$25","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"181.215.247.31\": ...\n URL: http://secureserver202.ddns.net/ (AV positives: 3/67 scanned on 04/27/2018 07:11:53)\n URL: http://secureserver202.duckdns.org/ (AV positives: 1/67 scanned on 04/27/2018 07:11:30)\n URL: http://181.215.247.31/ (AV positives: 1/67 scanned on 04/18/2018 07:52:35)\n URL: http://www.sandeeprecruit.duckdns.org/ (AV positives: 2/67 scanned on 03/23/2018 11:09:04)\n URL: http://sandeeprecruit.duckdns.org/ (AV positives: 1/67 scanned on 03/23/2018 10:23:10)\n File SHA256: 006c74b8193ed4dbf8093cf8ed4c5715ea58e16702a1c443611e97b8d8c0e44e (Date: 03/24/2018 11:30:51)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 181.215.247.31 on port 25255\n TCP traffic to 185.208.211.142 on port 25255","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.dll at 329-2552-004482D0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"$26","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":78,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":49,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["neshta","petya","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5b0ef2809ac508f90ba0aafc","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"AutoIt.DR.gen","contacted_countries":["CHL","NLD"],"submit_name":"msserver.exe","analysis_start_time":"2018-05-30T19:48:26+00:00","indicators_count":{"informative":25,"suspicious":38,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"181.215.247.31","port":25255,"protocol":"TCP","country":"Chile","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"address":"185.208.211.142","port":25255,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]}],"dns_resolutions":[{"domain":"secureserver202.duckdns.org","address":"181.215.247.31","ttl":59,"country":"Chile","registrar_name":"Gandi SAS","registrar_name_servers":"NS1.DUCKDNS.ORG","registrar_creation_date":"2013-04-12T19:58:56+00:00","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"domain":"apache202.duckdns.org","address":"185.208.211.142","ttl":59,"country":"Netherlands","registrar_name":"Gandi SAS","registrar_name_servers":"NS1.DUCKDNS.ORG","registrar_creation_date":"2013-04-12T19:58:56+00:00","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}],"processes":[{"pid":5048,"ppid":0,"name":"msserver.exe","command_line":"","sha256":"9a76ac2c893154592a09a179e5af2c86c8871265d009014bfb5ab25fabdb448a","normalized_path":"C:\\msserver.exe","uid":"00011809-00005048","icon":"$27"},{"pid":3312,"ppid":5048,"name":"msserver.exe","command_line":"","sha256":"9a76ac2c893154592a09a179e5af2c86c8871265d009014bfb5ab25fabdb448a","normalized_path":"C:\\msserver.exe","parent_uid":"00011809-00005048","uid":"00012128-00003312"},{"pid":3936,"ppid":3312,"name":"schtasks.exe","command_line":"/create /f /tn \"SCSI Service\" /xml \"%TEMP%\\tmpF38D.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00012128-00003312","uid":"00012381-00003936"},{"pid":4876,"ppid":3312,"name":"schtasks.exe","command_line":"/create /f /tn \"SCSI Service Task\" /xml \"%TEMP%\\tmpF498.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00012128-00003312","uid":"00012397-00004876"}],"all_imported_dlls":["winmm.dll","msvcr80.dll","mscorjit.dll","WSHTCPIP.DLL","api-ms-win-downlevel-normaliz-l1-1-0.dll","rsaenh.dll","taskschd.dll","comctl32.dll","wow64.dll","dwmapi.dll","api-ms-win-core-synch-l1-2-0.dll","System.ni.dll","tzres.dll","System.Xml.ni.dll","clbcatq.dll","wow64win.dll","shlwapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","winnsi.dll","System.Drawing.ni.dll","System.Windows.Forms.dll","wship6.dll","uxtheme.dll","comdlg32.dll","devobj.dll","dnsapi.dll","ktmw32.dll","KernelBase.dll","wininet.dll","kernel32.dll","cryptsp.dll","Microsoft.VisualBasic.ni.dll","wsock32.dll","rpcrt4.dll","usp10.dll","profapi.dll","cfgmgr32.dll","sspicli.dll","nsi.dll","normaliz.dll","iertutil.dll","userenv.dll","psapi.dll","apphelp.dll","System.Windows.Forms.ni.dll","ntdll.dll","api-ms-win-downlevel-version-l1-1-0.dll","ole32.dll","oleaut32.dll","bcrypt.dll","diasymreader.dll","wow64cpu.dll","user32.dll","msvcrt.dll","cryptbase.dll","sechost.dll","version.dll","mscorlib.ni.dll","Culture.dll","lpk.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","mscorrc.dll","System.Configuration.ni.dll","advapi32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","IPHLPAPI.DLL","imm32.dll","msctf.dll","mscorwks.dll","shfolder.dll","ws2_32.dll","mpr.dll","setupapi.dll","mscoree.dll","gdi32.dll","shell32.dll","mscoreei.dll","mswsock.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"tmpF38D.tmp","sha256":"54a2e9689416fcfeeb894f53b08780a99d2ec8282a07df6fe85e95d4c2f2ec18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"tmpF498.tmp","sha256":"3e70b8c0039e499fdb46c4630d8178cbb82b49bf09358ebedfeb5a9ccdade175","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"KB_194125.dat","sha256":"c07c18035ff7de9ece7b79d4a9d1237be13ab9a9ba5b660151fcccb707b28916","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"run.dat","sha256":"754f14a7620f7150546ac94264c207c376d6d8badc687e6ecf703eabe41b8992","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"autDEDD.tmp","sha256":"4efaec02744324aa68f17fd2ab9c2f84be3ad7dd3512ba6adc1dc493bfe43b12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]}],"files_written":[{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%APPDATA%\\lvnufkfxskrprhmkexncuyajm5217663.png","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\SysWOW64\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"C:\\msserver.exe.config","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index256.dat","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\SysWOW64\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\run.dat","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%PROGRAMFILES%\\(x86)\\SCSI Service","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"C:\\msserver.exe","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%PROGRAMFILES%\\(x86)\\SCSI Service\\scsisv.exe","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%PROGRAMFILES%\\(x86)\\SCSI Service\\scsisv.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\symbols\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\SysWOW64\\schtasks.exe","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%TEMP%\\tmpF38D.tmp","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%TEMP%\\tmpF498.tmp","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\Logs","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\Logs\\BrHzwXV","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"path":"%APPDATA%\\6B06490D-F9FD-424C-8B6D-83EDC4369E89\\Logs\\BrHzwXV\\KB_194125.dat","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{8f3a5ca1-d535-4a5a-8d23-c2f965ff6162}","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]},{"name":"Global\\{8f3a5ca1-d535-4a5a-8d23-c2f965ff6162}","sources":[{"report_type":"sandbox","report_id":"5b0ef2809ac508f90ba0aafc"}]}]}},"report_ids":{"sandbox_job_ids":["5b0ef2809ac508f90ba0aafc"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 9a76ac2c8931… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9a76ac2c8931…. Malware family: Trojan.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 12 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9a76ac2c893154592a09a179e5af2c86c8871265d009014bfb5ab25fabdb448a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 9a76ac2c8931… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9a76ac2c8931…. Malware family: Trojan.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 12 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9a76ac2c893154592a09a179e5af2c86c8871265d009014bfb5ab25fabdb448a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 9a76ac2c8931… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9a76ac2c8931…. Malware family: Trojan.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 12 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]