21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 59:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T49a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious QD:Trojan.GenericQ Sample 9c5ccde7c7de… — Score 82/100 — Hybrid Analysis","description":"Malicious verdict for sample 9c5ccde7c7de…. Malware family: QD:Trojan.GenericQ. Threat score 82/100. 8/24 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2","keywords":["Malicious","QD:Trojan.GenericQ","malware analysis","sandbox report","threat intelligence","9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2"],"about":{"@type":"SoftwareApplication","name":"ArcaneX.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2","additionalType":"Malicious sample"},"threatScore":82,"malwareFamily":"QD:Trojan.GenericQ","antivirusDetections":{"malicious":8,"total":24},"behavioralIndicators":{"malicious":3,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T4f0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADeklEQVR4XqWWuU7rUBCG51HY97AvYReEfYew7xX0PAA1DRVlXoIKpQoNT4CE6BEPAC0C5t7/5I6ZjO1jo/tLR3Icxf7yzXiOif5mfHycx8bGeHR0lEdGRnhoaMitbDbLAwMD3N/fz319fdzb28s9PT3c3d3NXV1d3NHRwe3t7ZzJZLitrY1bW1u5paWFm5ubuampiRsbG7mhoYHr6+u5traWa2pquLq6mquqqoJFExMTbCGGh4fdAsTg4KADiYPo7Ox0IGWIMkgURF1dnVsWhCYnJzkKAiYAAQAsnwlApDUBCABgOYBcLsdxENaChbAWfBAAEBPaAk1NTbEPQpuIgrA98VOOMARMYAECNvAbmp6e5iSIJBMWwmcCALgOzsMEzc7O8szMTCJEpYnfNGYYAn8GILAQAPzGxOXlJdvgNxYgyQR6gubn53lubo7TmLBJUw6fCUDQwsICC4TPhL4xbEhPrK2t8dfXF39/f/P5+XkFRBoTtLi4yBoiyoSOlOP+/r7ivA6A4nsiUwFBS0tLLBAaQEzoAAjlsHl/f7enXCxAlAlaXl5mDaFNAEIH5SgUCsFn/XTI3mGT1BO0srLCcRDPz8/BhQCkywETuLmOzAkdmZhxPUGrq6uMFQWhAxui3zbmy8uLHDoTt7e3wedisRh6OnRP0MHBgQPY29sLQegA4Obmxh3DRKlUcseAklIgsnnp+PYOOjo6cjff399nWw4dlODi4sIdoxmvrq6C7/BkyJyQrVzHNyfo8PCQ19fX3fMMExpCR+YEgvIAYmNjw9lAOd7e3tx3sKHtfXx8eIcVbW5ucj6fdxcDiO6J19fX4EKoMyAk29vbDgLr8fHRnXt4eAhNTNzY91JDW1tb/wDykSZ05PGMytPTk+sH27xJuyjhnwAiygQgbPScgGqUQCamHVzoGTsnLATt7Ow4nRrCmrD5/PysmJh2YEnQD0nvE7S7u8tRELYnfhu7lVea+OkJwiMYB2FNYJNJyt3dXbCLAkDmhEBYE4Tn3wchJgACCKzr62t7Xz47OwtKIk+HfZ8Im8iWJ2EShDVhJ2aa9wkLISbcJMQwSoLQJgQkCkI3ZxoTAYDPhG9OJL1PJJmgk5MTPj4+5h8TZRALEWVCeiKNiTgIOj09ZYFIZyJcCmvCvtT4TDgADZG2JwChTfggfCYCAGsiLcT/mvgDfpFLSOjeYHsAAAAASUVORK5CYII=23:T434,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005084.00000000.119634.0815A000.00000002.mdmp")24:T50a,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "Failed to map file. CreateFileW(%s) failed with error %d" (Indicator: "CreateFile"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "Failed to map file. CreateFileMappingW(%s) failed with error %d" (Indicator: "CreateFile"; File: "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005084.00000000.119634.0815A000.00000002.mdmp, 00000000-00005084.00000001.119911.9D142000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005084.00000000.119634.0815A000.00000002.mdmp")25:Ta07,"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin" contains export function called "CLRJitAttachState" at ordinal 3 "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin" contains export function called "DotNetRuntimeInfo" at ordinal 4 "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin" contains export function called "MetaDataGetDispenser" at ordinal 5 "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin" contains export function called "g_CLREngineMetrics" at ordinal 2 "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin" contains export function called "g_dacTable" at ordinal 6 "D3DCompiler_47_cor3.dll" contains export function called "D3DAssemble" at ordinal 1 "D3DCompiler_47_cor3.dll" contains export function called "D3DCompile" at ordinal 3 "D3DCompiler_47_cor3.dll" contains export function called "D3DCompile2" at ordinal 4 "D3DCompiler_47_cor3.dll" contains export function called "D3DCompileFromFile" at ordinal 5 "D3DCompiler_47_cor3.dll" contains export function called "D3DCompressShaders" at ordinal 6 "D3DCompiler_47_cor3.dll" contains export function called "D3DCreateBlob" at ordinal 7 "D3DCompiler_47_cor3.dll" contains export function called "D3DCreateFunctionLinkingGraph" at ordinal 8 "D3DCompiler_47_cor3.dll" contains export function called "D3DCreateLinker" at ordinal 9 "D3DCompiler_47_cor3.dll" contains export function called "D3DDecompressShaders" at ordinal 10 "D3DCompiler_47_cor3.dll" contains export function called "D3DDisassemble" at ordinal 11 "D3DCompiler_47_cor3.dll" contains export function called "D3DDisassemble10Effect" at ordinal 12 "D3DCompiler_47_cor3.dll" contains export function called "D3DDisassemble11Trace" at ordinal 13 "D3DCompiler_47_cor3.dll" contains export function called "D3DDisassembleRegion" at ordinal 14 "D3DCompiler_47_cor3.dll" contains export function called "D3DGetBlobPart" at ordinal 15 "D3DCompiler_47_cor3.dll" contains export function called "D3DGetDebugInfo" at ordinal 16 "D3DCompiler_47_cor3.dll" contains export function called "D3DGetInputAndOutputSignatureBlob" at ordinal 17 "D3DCompiler_47_cor3.dll" contains export function called "D3DGetInputSignatureBlob" at ordinal 18 "D3DCompiler_47_cor3.dll" contains export function called "D3DGetOutputSignatureBlob" at ordinal 19 "D3DCompiler_47_cor3.dll" contains export function called "D3DGetTraceInstructionOffsets" at ordinal 20 "D3DCompiler_47_cor3.dll" contains export function called "D3DLoadModule" at ordinal 2126:T46c,"9iqmgvw,czcser_o!yjthawte," - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e;rwoj;!!dk" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;;rwos;!!dk" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0%s_xpx!dkeriss2.5.29.10" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3.rv[j1n8j0/^g(1.3.6.1.5.5.7.1.12h" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005084.00000001.119911.64200000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mi" - Source: "00000000-00005084.00000001.119911.646E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005084.00000001.119911.646E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*i='e20170929123018.134z0washington1redmond1micrprporation1aoc1'0%ncipher" - Source: "00000000-00005084.00000001.119911.64822000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005084.00000001.119911.64822000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/pr3ictimstapca_2010-07-01.c=n0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005084.00000001.119911.64822000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@/t'!washington1redmond1microsoft" - Source: "00000000-00005084.00000001.119911.64822000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005084.00000001.119911.64822000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005084.00000001.119911.9D142000.00000002.mdmp")3e:T57b7,"" (Indicator: "password"; Source: "00000000-00005084.00000001.119911.64822000.00000004.mdmp")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[{"name":"5we4ac5f.3l4","sha256":"5828e602edf3eed6fd143b403b853b481ab58f812b8f4aaf559983d2c5774027","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"__PSScriptPolicyTest_fyrfxaib.hdi.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"PresentationNative_cor3.dll","sha256":"00b7947c843a7564a0b168ed46abfdb87f6aa6bac8ca1bb277760f872c82ff95","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"vcruntime140_cor3.dll","sha256":"d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"rblx_6ee073b0-46c7-4a3f-b722-57ea3ae551e2.ps1","sha256":"57d66b01d32e5dec63761efc066cdea2f978a7f0260d2df576773c4523fad21d","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}],"verdict":"undetected"},{"name":"__PSScriptPolicyTest_oqt1rh4s.rfv.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"wpfgfx_cor3.dll","sha256":"07c3631d158122ac48110bf81b1f67aa80c6965c8996ac1dda534b2766970b83","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"PenImc_cor3.dll","sha256":"8ce3af4e7aaead8158a4ca267be93bba0af4f32c7d27368c71c3a7eb0960dbcc","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"r04xoqn3.x2w","sha256":"5828e602edf3eed6fd143b403b853b481ab58f812b8f4aaf559983d2c5774027","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}],"verdict":"undetected"},{"name":"D3DCompiler_47_cor3.dll","sha256":"a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"rblx_c4f8349d-0a2d-46e7-9ede-c3fafb037e0c.ps1","sha256":"57d66b01d32e5dec63761efc066cdea2f978a7f0260d2df576773c4523fad21d","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%TEMP%\\.net\\9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\\1720\\D3DCompiler_47_cor3.dll","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static,8.0.26","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,AvalonEdit,6.3.0.90","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\rblx_6ee073b0-46c7-4a3f-b722-57ea3ae551e2.ps1","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"path":"%TEMP%\\.net\\9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\\1720\\PenImc_cor3.dll","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\.net\\9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\\1720\\PresentationNative_cor3.dll","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"path":"%TEMP%\\.net\\9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\\1720\\wpfgfx_cor3.dll","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,AvalonEdit","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_3yhbqehs.kqu.psm1","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\WPF\\r04xoqn3.x2w","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\.net\\ArcaneX\\2128\\vcruntime140_cor3.dll","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_lwq43ezl.x53.ps1","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\.net\\9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\\1720\\vcruntime140_cor3.dll","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"path":"%TEMP%\\.net\\ArcaneX\\2128\\D3DCompiler_47_cor3.dll","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\.net\\ArcaneX\\2128\\wpfgfx_cor3.dll","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\rblx_c4f8349d-0a2d-46e7-9ede-c3fafb037e0c.ps1","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\WPF\\5we4ac5f.3l4","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\.net\\ArcaneX\\2128\\PenImc_cor3.dll","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\.net\\ArcaneX\\2128\\PresentationNative_cor3.dll","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_oqt1rh4s.rfv.ps1","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_fyrfxaib.hdi.psm1","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:8488:304:WilStaging_02","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"Local\\SM0:3776:304:WilStaging_02","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"Local\\SM0:3776:120:WilError_03","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5084:120:WilError_01","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"name":"SM0:5084:120:WilError_01","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8488:304:WilStaging_02","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"Local\\SM0:8580:304:WilStaging_02","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3776:304:WilStaging_02","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawCheckExclMode__","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5920:304:WilStaging_02","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawExclMode__","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"Local\\SM0:5084:304:WilStaging_02","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"SM0:8488:120:WilError_03","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3776:120:WilError_03","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"SM0:3776:120:WilError_03","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5084:304:WilStaging_02","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"name":"SM0:5084:304:WilStaging_02","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5084:304:WilStaging_02","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"name":"__DDrawExclMode__","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"Local\\SM0:5920:304:WilStaging_02","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8488:120:WilError_03","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8580:304:WilStaging_02","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3776:120:WilError_03","sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"name":"__DDrawCheckExclMode__","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["icuuc.dll","apphelp.dll","vcruntime140_1_clr0400.dll","BCP47Langs.dll","9xk1NTBo.dll","System.Transactions.ni.dll","twinapi.appcore.dll","ntmarta.dll","user32.dll","PresentationNative_cor3.dll","wintrust.dll","sspicli.dll","msvcrt.dll","userenv.dll","psapi.dll","d3d10warp.dll","urlmon.dll","mscoree.dll","profapi.dll","System.ni.dll","umpdc.dll","kernel32.dll","d3d9.dll","rsaenh.dll","dxgi.dll","MpClient.dll","WinTypes.dll","VxSSL64.dll","System.Transactions.dll","System.Data.ni.dll","DataExchange.dll","ws2_32.dll","CoreUIComponents.dll","atl.dll","System.Xml.ni.dll","icuin.dll","msctfui.dll","kernel.appcore.dll","iertutil.dll","ntdll.dll","Windows.Globalization.dll","ucrtbase_clr0400.dll","Microsoft.PowerShell.Commands.Management.ni.dll","version.dll","d3d11.dll","System.DirectoryServices.ni.dll","msisip.dll","srvcli.dll","TextShaping.dll","mscorlib.ni.dll","CoreMessaging.dll","amsi.dll","DWrite.dll","System.Numerics.ni.dll","pwrshsip.dll","System.Management.ni.dll","advapi32.dll","win32u.dll","1Qg425BQ.dll","System.Management.Automation.ni.dll","oleaut32.dll","Microsoft.PowerShell.Security.ni.dll","fltLib.dll","shlwapi.dll","wpfgfx_cor3.dll","KernelBase.dll","System.Configuration.ni.dll","winsta.dll","cfgmgr32.dll","directxdatabasehelper.dll","cryptbase.dll","msvcp_win.dll","uxtheme.dll","shell32.dll","gdi32.dll","imagehlp.dll","secur32.dll","mscoreei.dll","gdi32full.dll","clbcatq.dll","dcomp.dll","rpcrt4.dll","System.Configuration.Install.ni.dll","TextInputFramework.dll","vcruntime140_clr0400.dll","UIAutomationCore.dll","powrprof.dll","MpOAV.dll","cryptsp.dll","ucrtbase.dll","crypt32.dll","imm32.dll","windows.storage.dll","slc.dll","WindowsCodecs.dll","DXCore.dll","sechost.dll","ole32.dll","wtsapi32.dll","System.Data.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","icu.dll","rmclient.dll","bcryptprimitives.dll","bcrypt.dll","netutils.dll","wshext.dll","Microsoft.Management.Infrastructure.ni.dll","SHCore.dll","msasn1.dll","combase.dll","gpapi.dll","msctf.dll","wldp.dll","IconCodecService.dll","clr.dll","sppc.dll","ResourcePolicyClient.dll","System.Core.ni.dll","dwmapi.dll","D3DCompiler_47_cor3.dll","AppxSip.dll","clrjit.dll"],"processes":[{"command_line":"","icon":"$22","name":"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin.exe","normalized_path":"C:\\9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin.exe","pid":5920,"ppid":0,"sha256":"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2","uid":"00000000-00005920"},{"command_line":"/c start /b powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -File \"%TEMP%\\rblx_6ee073b0-46c7-4a3f-b722-57ea3ae551e2.ps1\"","name":"cmd.exe","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00005920","pid":4108,"ppid":5920,"sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","uid":"00000000-00004108"},{"command_line":"-ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -File \"%TEMP%\\rblx_6ee073b0-46c7-4a3f-b722-57ea3ae551e2.ps1\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004108","pid":5084,"ppid":4108,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00005084"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2026-07-14T17:21:08+00:00","environment_description":"Windows 11 64 bit","environment_id":140,"id":"6a566fff9e31328ea40bd9a2","indicators_count":{"informative":220,"malicious":3,"suspicious":40},"is_in_unified_schema":true,"malware_family":"QD:Trojan.GenericQ","state":"SUCCESS","submit_name":"ArcaneX.exe","tags":["Multi-Process","Extracted Files"],"threat_score":82,"verdict":"malicious"},{"analysis_start_time":"2026-06-29T12:32:46+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"6a4265e96884303587055f88","indicators_count":{"informative":216,"malicious":2,"suspicious":39},"is_in_unified_schema":true,"malware_family":"Tool.PSWDump.Win64","state":"SUCCESS","submit_name":"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin","tags":["Multi-Process","Extracted Files"],"threat_score":80,"verdict":"malicious"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":12,"files_deleted_count":0,"files_written_count":28,"http_requests_count":0,"imported_dlls_count":123,"injected_processes_count":0,"mutex_created_count":25,"process_count":3,"registry_keys_created_count":21,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":21,"script_calls_count":0,"spawned_processes_count":3}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"QD:Trojan.GenericQ"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware/Win.Generic","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TR/W64.Malware","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"QD:Trojan.GenericKDQ.60D3B79C94","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"QD:Trojan.GenericKDQ.60D3B79C94 (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"MSIL/Spy.Agent.FYC trojan","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Spyware ( 006e233b1 )","verdict":"malicious"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sentinelone":{"data_source":"MetaDefender","name":"SentinelOne","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W64/ABmRisk.CESE-2323","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Tool.PSWDump.Win64.1006","verdict":"malicious"}}},"incidents":[{"details":[{"detail":"Queries kernel debugger information"}],"details_count":1,"name":"Fingerprint","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"details":[{"detail":"Marks file for deletion"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}]},{"details":[{"detail":"Creates new processes"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Transport Agent"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Able to access control system service controller"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Local Storage"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to retrieve file and directory information"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL"},{"attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Mutual Exclusion"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Local Storage Discovery"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Command line contains PowerShell"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Execution","technique":"PowerShell"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Bidirectional Communication"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Account Discovery"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Security Account Manager"},{"attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"},{"type":"informative","value":"Contains ability to interact with Microsoft Outlook"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Execution","technique":"Component Object Model"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Bypass User Account Control"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Execution","technique":"Command and Scripting Interpreter"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Reconnaissance","technique":"Vulnerability Scanning"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Checks"},{"attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive via Library"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Service"},{"attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Manipulation"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Junk Code Insertion"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Tries to access/write temporary files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"}],"rule_matches":{},"sandbox_signatures":[{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\")","id":"string-439","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify process memory (API string)","origin":"File/Memory","sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$23","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Able to query system locale information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"cmd.exe\" with commandline \"/c start /b powershell.exe -ExecutionPolicy Bypass -WindowStyle ...\" (UID: 00000000-00004108)\n Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInter ...\" (UID: 00000000-00005084)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"General","description":"$24","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"rblx_6ee073b0-46c7-4a3f-b722-57ea3ae551e2.ps1\")","id":"string-106","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to decode base64 data","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"General","description":"Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -File \"%TEMP%\\\\rblx_6ee073b0-46c7-4a3f-b722-57ea3ae551e2.ps1\"\" (UID: 00000000-00005084)","id":"target-486","level":"informative","mitre_attack_id":"T1059.001","name":"Executes PowerShell with command line","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"General","description":"Antivirus vendors marked dropped file \"D3DCompiler_47_cor3.dll\" as clean (type is \"PE32+ executable for MS Windows 6.02 (DLL) x86-64 8 sections\"), Antivirus vendors marked dropped file \"wpfgfx_cor3.dll\" as clean (type is \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\"), Antivirus vendors marked dropped file \"PresentationNative_cor3.dll\" as clean (type is \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\"), Antivirus vendors marked dropped file \"PenImc_cor3.dll\" as clean (type is \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\"), Antivirus vendors marked dropped file \"vcruntime140_cor3.dll\" as clean (type is \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\")","id":"binary-16","level":"informative","name":"Drops files marked as clean","origin":"Binary File","relevance":10,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005084.00000001.119911.2AB60000.00000004.mdmp\")","id":"string-126","level":"informative","mitre_attack_id":"T1082","name":"Found system command-related strings","origin":"File/Memory","relevance":7,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00005920-00000C2B-838298727\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\")","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string(File: \"rblx_6ee073b0-46c7-4a3f-b722-57ea3ae551e2.ps1\")","id":"string-726","level":"informative","mitre_attack_id":"T1083","name":"Able to retrieve file and directory information","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for encryption algorithm file \"D3DCompiler_47_cor3.dll\"","id":"yara-208","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match – Encryption algorithm","origin":"YARA Signature","relevance":7,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\")\n Found reference to API \"GetWindowsDirectory failed. Error code: %d\" (Indicator: \"GetWindowsDirectory\"; File: \"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 6.01 (DLL)\n x86-64\n 6 sections","id":"static-97","level":"malicious","mitre_attack_id":"T1027.009","name":"PE file contains executable resources","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005084.00000001.119911.9D142000.00000002.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","id":"yara-26","level":"informative","mitre_attack_id":"T1027.009","name":"YARA signature match - PE executable embedded in .rsrc section","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found system information discovery API: \"GetSystemInfo\" in file \"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.bin\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00005084.00000000.119634.0815A000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00005084.00000001.119911.9D142000.00000002.mdmp\"","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4265e96884303587055f88","report_type":"sandbox"},{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"General","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00003776.00000001.157957.8C873000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003776.00000001.157957.8C873000.00000002.mdmp\")","id":"string-930","level":"informative","mitre_attack_id":"T1059.003","name":"Able to retrieve command line parameters of the running process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a566fff9e31328ea40bd9a2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"