33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 41:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 35:T9e2,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "BuildProtectedSecurity" (Indicator: "security"; Source: "sample.bin"), Found reference to API "i__Field" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "SFEdge task timed out after 500ms" (Indicator: "time"; Source: "sample.bin"), Found reference to API "_closeApproved" (Indicator: "close"; Source: "sample.bin"), Found reference to API "IStoreInstaller.Acquisition.WuAllUsersInstaller+d__10" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "RebootRequiredToFinish" (Indicator: "reboot"; Source: "sample.bin"), Found reference to API "TrackPackagedInstallAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "b__3" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "b__0" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "StartProductInstallAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "FindClosestLanguage" (Indicator: "close"; Source: "sample.bin"), Found reference to API "ReadString" (Indicator: "read"; Source: "sample.bin"), Found reference to API "^StoreInstaller.Acquisition.PackageRetrieval.PackageManagerDeployer+d__13" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "System.Runtime.WindowsRuntime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "LaunchProductAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "CStoreInstaller.Acquisition.WpmInstaller+d__14" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "AsyncOperationProgressHandler`2" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "b__0" (Indicator: "close"; Source: "sample.bin"), Found reference to API "b__1" (Indicator: "close"; Source: "sample.bin"), Found reference to API "b__2" (Indicator: "close"; Source: "sample.bin"), Found reference to API "b__3" (Indicator: "close"; Source: "sample.bin"), Found reference to API "IID_ICreateCompositePackageCatalogOptions" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "k__BackingField" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "WindowsUpdateStatusHelper" (Indicator: "stat"; Source: "sample.bin")36:T566,Found reference to API (Indicator: "CreateEvent"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process2"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileName"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "sample.bin"), Found reference to API (Indicator: "QueueUserWorkItem"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessById"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin")37:T644,Found XOR loop in file "sample.bin" at offset 496762; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 521629; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 576080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 590415; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 629471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 665734; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 773013; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 133944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 173255; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 173583; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 174175; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 174903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 179519; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 181871; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 512289; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 566969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 576793; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 582030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 582158; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 583912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 807066; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 808751; code bytes = 803038:T70c,"SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000628) "SetupAssistantInstaller.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000628)39:T465,"Setup Assistant Installer.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],sub al, byte ptr [eax],add byte ptr [eax], al,add byte ptr es:[eax], al,add byte ptr [ecx], ch,add byte ptr [eax], al,add byte ptr [0x24000000], ah,add byte ptr [eax], al,add byte ptr [eax + eax], bl,add byte ptr [eax], al,sbb al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3a:T6ab,"SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "")3b:Tb45,"SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C1376338-0984-48B8-B933-9C7D779FD84D"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "319DC449-ADA5-50F7-428E-957DB6791668"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "SetupAssistantInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "")3c:T41a,"SetupAssistantInstaller.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "SetupAssistantInstaller.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL" "SetupAssistantInstaller.exe" trying to touch file "\Device\KsecDD" "SetupAssistantInstaller.exe" trying to touch file "C:\Windows\System32\MSCOREE.DLL.local" "SetupAssistantInstaller.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "SetupAssistantInstaller.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" "SetupAssistantInstaller.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "SetupAssistantInstaller.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "SetupAssistantInstaller.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "SetupAssistantInstaller.exe" trying to touch file "C:\SetupAssistantInstaller.exe.config" "SetupAssistantInstaller.exe" trying to touch file "C:\SetupAssistantInstaller.exe"3d:T893,"SetupAssistantInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\11723c46cea53a98c07435785eae2ca8\System.Core.ni.dll" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\11723c46cea53a98c07435785eae2ca8\System.Core.ni.dll" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\11723c46cea53a98c07435785eae2ca8\System.Core.ni.exe" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\11723c46cea53a98c07435785eae2ca8\System.Core.ni.exe" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.dll" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.dll" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.exe" "SetupAssistantInstaller.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.exe"3e:T835,Found string "IsWow64Process2" (Source: Setup Assistant Installer.exe, API is part of module: KERNELBASE.DLL) Found string "GetModuleFileNameW" (Source: Setup Assistant Installer.exe, API is part of module: KERNELBASE.DLL) Found string "CoCreateInstance" (Source: Setup Assistant Installer.exe, API is part of module: COMBASE.DLL) Found string "Rectangle" (Source: Setup Assistant Installer.exe, API is part of module: GDI32FULL.DLL) Found string "GetCurrentThemeName" (Source: Setup Assistant Installer.exe, API is part of module: UXTHEME.DLL) Found string "SetWindowThemeAttribute" (Source: Setup Assistant Installer.exe, API is part of module: UXTHEME.DLL) Found string "IsThemeActive" (Source: Setup Assistant Installer.exe, API is part of module: UXTHEME.DLL) Found string "QueueUserWorkItem" (Source: Setup Assistant Installer.exe, API is part of module: KERNELBASE.DLL) Found string "Sleep" (Source: Setup Assistant Installer.exe, API is part of module: KERNELBASE.DLL) Found string "GetSystemMetrics" (Source: Setup Assistant Installer.exe, API is part of module: USER32.DLL) Found string "SetDefaultDllDirectories" (Source: Setup Assistant Installer.exe, API is part of module: KERNELBASE.DLL) Found string "EnumProcessModules" (Source: Setup Assistant Installer.exe, API is part of module: PSAPI.DLL) Found string "NtQueryInformationProcess" (Source: Setup Assistant Installer.exe, API is part of module: NTDLL.DLL) Found string "GetCurrentProcess" (Source: Setup Assistant Installer.exe, API is part of module: KERNELBASE.DLL) Found string "AllowSetForegroundWindow" (Source: Setup Assistant Installer.exe, API is part of module: USER32.DLL) Found string "IsWindow" (Source: Setup Assistant Installer.exe, API is part of module: USER32.DLL) Found string "GetWindow" (Source: Setup Assistant Installer.exe, API is part of module: USER32.DLL) Found string "ReleaseMutex" (Source: Setup Assistant Installer.exe, API is part of module: KERNELBASE.DLL) Found string "GetPackagesByPackageFamily" (Source: Setup Assistant Installer.exe, API is part of module: KERNEL.APPCORE.DLL)3f:T504,System.Activator::CreateInstance(System.Type,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object[],System.Globalization.CultureInfo) at 42c097eadea8df11de34ff53db549777-60001fc-GeneratedInternalTypeHelper~CreateInstance System.Reflection.PropertyInfo::GetValue(System.Object,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object[],System.Globalization.CultureInfo) at 42c097eadea8df11de34ff53db549777-60001fd-GeneratedInternalTypeHelper~GetPropertyValue System.Reflection.PropertyInfo::SetValue(System.Object,System.Object,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object[],System.Globalization.CultureInfo) at 42c097eadea8df11de34ff53db549777-60001fe-GeneratedInternalTypeHelper~SetPropertyValue System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[],System.Globalization.CultureInfo) at 42c097eadea8df11de34ff53db549777-60001ff-GeneratedInternalTypeHelper~CreateDelegate Windows.ApplicationModel.Package::GetAppListEntriesAsync() at 42c097eadea8df11de34ff53db549777-600076a-AppActivationActivateAsyncd__0~MoveNext System.Type::GetProperty(System.String,System.Reflection.BindingFlags) at 42c097eadea8df11de34ff53db549777-60003e4-DpiHelper~GetSystemDpi40:T984,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAG6UlEQVR4XsWTaVCVZRTHrUkvF0QWCbmXfbMvOfWxRnFXQM21olwCWeRiamQppZYrZIuaIZaaGYkKmJKiFi0Ow1Rumem4Tn0opy9lMyrgBui//znP+957Xdo/9M785nm53vv8zv+cY6dOf/I8+APw4BnAVXUO7u1tcNW1K26lQ/H9bX0m36v6Fb1Od6AXf3vrnf/ouZ+XPHD6Bpxv/AznqmYEVLTegRY4eXrh95yvnUXqwctI2df63wpIPXgJwq2f/53H/elvcDec+1e/9T7R/+GSkNqz6Fb941//tnPRF+hS9LnFZ97TkfcR9JKan/Td4fmUn/vBv+Uzh+cTBBBH4R4EFH6MgCm7EJBdg87rTuOeNafgzKlGYP5OOPPredbz3MGT8E4twCc3OKZaheTtQOfyY7in/Cgc/IGRkcIGCht4fmwJhT1wTtkNZ8EuBBZQxgLuWnYYd5OgnBrK6sh2BFEaxPeg3A/RNXfbrQVIss80WRcKApjIkbMVjuxaXlxvySji6eQZQJkINVmBJNupSQPzKZlci8AJlQiaSFhM0ORtZCuhWGBRXXm3VYBIG9ClUFLZyT4xMpXU+2GE0kYn0wTmSStJbp2VrE5lPolNLbqykGC+B2dvIdUIfmqTKUBkDm0jKditOOXUue3UdCbZDgRZs1OhwrbmSjqTUFIpIvDKyFPCZnSjVJlUhW4TN1oF+CUzS2JkTp0bEYmm2865EU24zUpVrckUkWiyLegm0kkUTtrEc6Ml/EAJmfA+qVS0AG2ldzN9skBpo6TLkbnVWulMK6M9H6Lp1C+Qp/7QWcR6apjMJAyhVNIJISJURPg+QoXxGxD65HqEES3g5lbaS2LLTMJgwdvGzfC83aTyGzcMJRu+MhLKQnmGSkIRKe+p0EjfRegTaxH2xBqEZa0xBXjnJssiLVShaaW2U6SSStoo8PKymgMU38D169f1LKveh5An11EmIiOUhGEqW0fZWiWc4vCsdxD+uPC2KeA2mb9Q2yjt9JsdLy7b8rXKhY6ODpRt/lITqUyF76gsjBJb1l1Zje6PVRgefcsUYLZSoEwWZoIlk5ZKC+25Keu1hWWbv1Jxe3u7UrapCWG8NIwCkYU/XmHJVlnCVSrsPm4lInhGyEm0AP8lCZF52XOzZmdaaSXTVBUqbGtr8xZQurGRgnJLJmc5RTzHvcnTyO7l+71jl5MViJRzzDJTgE/2rpHpaYThMsMsmRvbJ0g6Xlxa1agFCNeuXUPpB3sRwYtNOorGrVBRxNhlRjrmDfI6elAayffI0XwnWoBZlDUqM0tiL8pqbWNC9jo0Hv1RZTu+PoPEiRVYUvkFrl696qW08nMkjV+JvYd/wJUrV1DXdBzJE1ZSJlIjixy1lLyKKNJjZJmiBejMsmRuRFpoLUqEtShFy+s1pSCyb06dRfnWJhXZlNc04tDJn3Dp0iUvJRW70GPUK2SpVxglPLIEUSMWw8VTCzALInNbpXPTNmorpYXLUbJ6t4r9hcLly5dVZJ82ra2tSlFZFSWLKSy1pIvgEjFP94iFcA9faArwbaXMzjc/mZvMK+nRUhw6/r1XanOr0KalpQUHvjuFlJHz4KLENXwBXMMWwO1lPnkZ7syXTAEqs7YyUhhtlsQsymuIZNWJI+fg4LEztwlF5k9zczMOHKF82Cy4MuZaMpJphNEZ88hcRKfPRQxPLSCSErMoPEe/ambmtyguzjGKlSePKMGBo6dvEzc3G/HFixex/8hJpGbOhHvoC4jOnGfIMLKYjDmISX8RsSRmaImiBfiWhAsj89JFKeX8BJnZYtNKVp88fBYlJ1RoS4ULFy5g37cnkJpRDPeQWUz4osoUFhNLmTJkNs/ZiON3Ygc/bwrwyZZYSyLCRSqVRXEP95sbL0vJfFZlIrXZd/g4eqbPQPTg5zSZvyyWMhHGURjHf48ncYOeRTzRAmQrZVF8MksoM1OkjXYr5yCal6VStrV+L86fP4+Gxv3oOXQ6YgYWq0ySxQ0xsrjBM42MZ/ygYsQPfMYwYAYSBky3ChAJ0yneRZmnc4tON3OLSX/BoOmYipe60woR9dAkuPsUIFYuVZkRxg0UWTES+LlgC+P7T+M5DYn9nyYeU4BspHdRKNQlUZkgLTRtNK2UZFYrKYrlxXEisdMNEKGRJYhMERnpN5UUEQ8S+3qQkGYVEN9vPttqLwoX5A5zUySZNTu7jYbpmkrpb6czsiTFg6S+hRZTkJRWgKTeeUZuP/Hp/G8xyBbN9M1OZb7ZJVitvFnmS3eTME1kQj6S+uQjWclDcu9c3Ncv++YC7EclIrTS+ctMK6ciQdtYpG0UvOlUVoBkChWR9clFitB7MlIezqE8G/F/JP+/nt8BtAqhBo4bw/AAAAAASUVORK5CYII=30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 9cd7f951623e… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 9cd7f951623e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/9cd7f951623eadcc479fdbf2453c02b83878c45980da4f16eb4bc10875d89027\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"9cd7f951623eadcc479fdbf2453c02b83878c45980da4f16eb4bc10875d89027\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"Setup Assistant Installer.exe\",\"applicationCategory\":[\"peexe\",\"assembly\",\"executable\"],\"identifier\":\"9cd7f951623eadcc479fdbf2453c02b83878c45980da4f16eb4bc10875d89027\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":24},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":9},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"9cd7f951623eadcc479fdbf2453c02b83878c45980da4f16eb4bc10875d89027","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793911980439,"unified_at":"2026-11-05T20:53:00.439Z","metadata":{"hashes":{"sha256":"9cd7f951623eadcc479fdbf2453c02b83878c45980da4f16eb4bc10875d89027","sha1":"adf0cdd52084b613d810ef1c94853538860b5ce1","md5":"42c097eadea8df11de34ff53db549777","sha512":"9060d212877bcca5251acbdaf2840529ac3fe621bcbdad69ac8bc4b8216085b551a7037bf67e956f77961e4112b65ce1a96bb5f0ed6917c87fb6e8469f3a15ed","ssdeep":"12288:dVFH26FQk+k+De/3JTTKR0SkhNcp3IGx/YMC9+Xy34l1OsfzGPnK:xIwcpYGJYF92y3w1O06PnK","ssdeep_chunks":["12288:dVFH26F","12288:VFH26FQ","12288:FH26FQk","12288:H26FQk+","12288:26FQk+k","12288:6FQk+k+","12288:FQk+k+D","12288:Qk+k+De","12288:k+k+De/","12288:+k+De/3","12288:k+De/3J","12288:+De/3JT","12288:De/3JTT","12288:e/3JTTK","12288:/3JTTKR","12288:3JTTKR0","12288:JTTKR0S","12288:TTKR0Sk","12288:TKR0Skh","12288:KR0SkhN","12288:R0SkhNc","12288:0SkhNcp","12288:SkhNcp3","12288:khNcp3I","12288:hNcp3IG","12288:Ncp3IGx","12288:cp3IGx/","12288:p3IGx/Y","12288:3IGx/YM","12288:IGx/YMC","12288:Gx/YMC9","12288:x/YMC9+","12288:/YMC9+X","12288:YMC9+Xy","12288:MC9+Xy3","12288:C9+Xy34","12288:9+Xy34l","12288:+Xy34l1","12288:Xy34l1O","12288:y34l1Os","12288:34l1Osf","12288:4l1Osfz","12288:l1OsfzG","12288:1OsfzGP","12288:OsfzGPn","12288:sfzGPnK","24576:dVFH26F","24576:VFH26FQ","24576:FH26FQk","24576:H26FQk+","24576:26FQk+k","24576:6FQk+k+","24576:FQk+k+D","24576:Qk+k+De","24576:k+k+De/","24576:+k+De/3","24576:k+De/3J","24576:+De/3JT","24576:De/3JTT","24576:e/3JTTK","24576:/3JTTKR","24576:3JTTKR0","24576:JTTKR0S","24576:TTKR0Sk","24576:TKR0Skh","24576:KR0SkhN","24576:R0SkhNc","24576:0SkhNcp","24576:SkhNcp3","24576:khNcp3I","24576:hNcp3IG","24576:Ncp3IGx","24576:cp3IGx/","24576:p3IGx/Y","24576:3IGx/YM","24576:IGx/YMC","24576:Gx/YMC9","24576:x/YMC9+","24576:/YMC9+X","24576:YMC9+Xy","24576:MC9+Xy3","24576:C9+Xy34","24576:9+Xy34l","24576:+Xy34l1","24576:Xy34l1O","24576:y34l1Os","24576:34l1Osf","24576:4l1Osfz","24576:l1OsfzG","24576:1OsfzGP","24576:OsfzGPn","24576:sfzGPnK","12288:xIwcpYG","12288:IwcpYGJ","12288:wcpYGJY","12288:cpYGJYF","12288:pYGJYF9","12288:YGJYF92","12288:GJYF92y","12288:JYF92y3","12288:YF92y3w","12288:F92y3w1","12288:92y3w1O","12288:2y3w1O0","12288:y3w1O06","12288:3w1O06P","12288:w1O06Pn","12288:1O06PnK"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Setup Assistant Installer.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":813088,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793911878000,"last_seen":1793911878000,"last_multi_scan":1793911878000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":39},"sandbox_signatures":{"informative_count":80,"suspicious_count":9,"malicious_count":0,"total":89},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Able to retrieve running process details (.NET)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Stealth","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"suspicious","value":"References security-related Windows services"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$35","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"k__BackingField\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"ShellExecuteException\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"get_ShellExecuteInstallFailed\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: sample.bin, \"RegistryWriter: Failed to create registry key at HKLM\\\" in Source: sample.bin, \"SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\StoreInstaller\\Inventory\" in Source: sample.bin, \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\" in Source: sample.bin, \"SYSTEM\\CurrentControlSet\\Services\\wuauserv\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\StoreInstaller\\Inventory\\\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Edg/103.0.1264.77 MicrosoftStore/29999.0.1.2\" (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/winfx/2006/xaml\", Pattern match: \"http://schemas.openxmlformats.org/markup-compatibility/2006\", Pattern match: \"https://bat.bing.com/action/0?ti=149009011&ver=2.4&vid={{vid}}&evt=custom&pagetype=purchase&ea=purchase\", Heuristic match: \"bat.bing.com\", Pattern match: \"https://storesdk.dsx.mp.microsoft.com/v8.0/sdk/products/contentid?market=\", Pattern match: \"https://bat.bing.com/action/0?ti=149009011&ver=2.4&vid={{vid}}&evt=custom&pagetype=cart&ea=begin_checkout\", Heuristic match: \"\n*.sm\", Pattern match: \"https://storeedge.microsoft.com/v9.0/pages/home?market=us&locale=en-us&devicefamily=windows.desktop&hydratecount=3&devicefamilyversion=&architecture=x64&smode=false\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://bat.bing.com\", Found HTTPS url \"https://storesdk.dsx.mp.microsoft.com\", Found HTTPS url \"https://storeedge.microsoft.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"10.0.12.0\" found in string \"PresentationBuildTasks\t10.0.12.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"get_Oid\" (Indicator: \"Oid\"; Source: \"sample.bin\"), Found reference to \"AsnEncodedData\" (Indicator: \"AsnEncodedData\"; Source: \"sample.bin\"), Found reference to \"HashAlgorithmName\" (Indicator: \"HashAlgorithm\"; Source: \"sample.bin\"), Found reference to \"RSASignaturePadding\" (Indicator: \"RSASignaturePadding\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageAsync\" (Indicator: \"sendmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"ToBase64String\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography.X509Certificates\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; Source: \"sample.bin\"), Found reference to API \"EnumProcessModules\" (Indicator: \"EnumProcessModules\"; Source: \"sample.bin\"), Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-217","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"TryDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"suspicious","category":"System Security","name":"References security-related Windows services","description":"\"SYSTEM\\CurrentControlSet\\Services\\wuauserv\" (Indicator: \"wuauserv\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1574.010","id":"string-43","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"SetupAssistantInstaller.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"SetupAssistantInstaller.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"SetupAssistantInstaller.exe\" queried SystemProcessInformation at 00000000-00000628-00000C15-917953159 [PID: 628]\n \"SetupAssistantInstaller.exe\" queried SystemProcessInformation at 00000000-00000628-00000C15-917961057 [PID: 628]\n \"SetupAssistantInstaller.exe\" queried SystemProcessInformation at 00000000-00000628-00000C15-918137120 [PID: 628]\n \"SetupAssistantInstaller.exe\" queried SystemProcessInformation at 00000000-00000628-00000C15-918145221 [PID: 628]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000628.00000000.165911.61200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to crypto DLLs","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$37","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_OSVersion\" (Source: \"00000000-00000628.00000000.165911.60F12000.00000002.mdmp\")\n Found string \"GetOSVersionFromRegistry\" (Source: \"00000000-00000628.00000000.165911.60F12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"SetupAssistantInstaller.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000628)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"SetupAssistantInstaller.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000628)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"SetupAssistantInstaller.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000628)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"SetupAssistantInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000628.00000000.165911.61200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"SetupAssistantInstaller.exe\" queried token user identity (UID: 00000000-00000628)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"SetupAssistantInstaller.exe\" queries volume information of \"C:\\SetupAssistantInstaller.exe\" at 00000000-00000628-00000C17-917814839","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"SetupAssistantInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"set_UseShellExecute\" (Source: \"00000000-00000628.00000000.165911.60F12000.00000002.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00000628.00000000.165911.60F12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineArgs\" (Source: \"00000000-00000628.00000000.165911.60F12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process SetupAssistantInstaller.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:628:304:WilStaging_02\"\n Process SetupAssistantInstaller.exe created mutex with name \"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"\n Process SetupAssistantInstaller.exe created mutex with name \"SM0:628:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Setup Assistant Installer.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"KEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\" in Source: 00000000-00000628.00000000.165911.60F12000.00000002.mdmp\n \"KEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: 00000000-00000628.00000000.165911.60F12000.00000002.mdmp\n \"KEY_CURRENT_USER\\Software\\Microsoft\\Windows\\DWM\" in Source: 00000000-00000628.00000000.165911.60F12000.00000002.mdmp\n \"egistryWriter: Failed to create registry key at HKLM\\\" in Source: 00000000-00000628.00000000.165911.60F12000.00000002.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\WOW6432N\" in Source: 00000000-00000628.00000000.165911.61200000.00000004.mdmp\n \"y\\Machine\\Software\\Classes\\AppID\\SetupAssistantInstaller.exe\" in Source: 00000000-00000628.00000000.165911.61200000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"SetupAssistantInstaller.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffe42040000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"SetupAssistantInstaller.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at 28EE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"SetupAssistantInstaller.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 68760000\n \"SetupAssistantInstaller.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 68D10000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"SetupAssistantInstaller.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 3D800000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"SetupAssistantInstaller.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6A5A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Setup Assistant Installer.exe\" was detected as \".NET\" and name: \"Library\"\n \"Setup Assistant Installer.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"Setup Assistant Installer.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Setup Assistant Installer.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Setup Assistant Installer.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$39","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Tencent\" (Indicator: \"tencent\") in Source: 600034c-ctor","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"SetupAssistantInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"SetupAssistantInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Marketplace CA G 023, OU=AOC, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 0F:7E:35:31:DB:08:4A:3D:45:75:96:70:B7:69:9E:53:98:5E:87:42; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority 2011, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: EB:92:04:78:51:26:C2:6A:DA:DC:BB:D4:4F:E2:B0:C6:42:A7:10:78; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft MarketPlace PCA 2011, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: AF:C2:2D:65:96:CA:F2:A7:A7:4A:D9:2B:27:2D:5C:BF:F8:91:6C:41; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Unknown issuer\" (SHA1: 93:82:AC:24:E7:0E:EA:DF:EE:13:E5:8A:28:BC:7D:5C:75:1A:36:CF; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"SetupAssistantInstaller.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"SetupAssistantInstaller.exe\" queries basic process information of the \"C:\\SetupAssistantInstaller.exe\" (UID: 628)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"SetupAssistantInstaller.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"SetupAssistantInstaller.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll.aux\"\n \"SetupAssistantInstaller.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\21ff4ba4607b18a9b179ab90fd3b0bc1\\system.core.ni.dll.aux\"\n \"SetupAssistantInstaller.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\fe3c9cf707273488c6c658d52d624640\\system.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"SetupAssistantInstaller.exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.local\"\n \"SetupAssistantInstaller.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL.local\"\n \"SetupAssistantInstaller.exe\" trying to access non-existent file \"C:\\SetupAssistantInstaller.exe.config\"\n \"SetupAssistantInstaller.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.localgac\"\n \"SetupAssistantInstaller.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\StoreInstaller\"\n \"SetupAssistantInstaller.exe\" trying to access non-existent file \"C:\\SetupAssistantInstaller.INI\"\n \"SetupAssistantInstaller.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\GAC\\PublisherPolicy.tme\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AppInstallTracking: Failed to connect to AppService (status={0})\" (Indicator: \" connect \"; File: \"Setup Assistant Installer.exe\")\n Found reference to API \"ppInstallTracking: Failed to connect to AppService (status={0})\" (Indicator: \" connect \"; Source: \"00000000-00000628.00000000.165911.60F12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEC8B5745B7F652CA49639D7E62CB5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000628.00000000.165911.61200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000628.00000000.165911.61200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"ue\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000628.00000000.165911.61200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00000628.00000000.165911.60F12000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00000628.00000000.165911.60F12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"SetupAssistantInstaller.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 42c097eadea8df11de34ff53db549777-60002dc-MultiInstanceHandler~IsRunningAsAdmin\n System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 42c097eadea8df11de34ff53db549777-60006a8-PackageRetrievalInstaller~IsProcessElevated","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000628.00000000.165911.61200000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000628.00000000.165911.61200000.00000004.mdmp, 00000000-00000628.00000000.165911.61340000.00000004.mdmp, 00000000-00000628.00000000.165911.614D0000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000628.00000000.165911.61200000.00000004.mdmp, 00000000-00000628.00000000.165911.61340000.00000004.mdmp, 00000000-00000628.00000000.165911.614D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"SetupAssistantInstaller.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"Setup Assistant Installer.exe\" has section name .rsrc with entropy \"7.921813581159145\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\SetupAssistantInstaller.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"Setup Assistant Installer.exe\" has resource with unusual entropy \"RT_ICON:7.986218795829092\"\n \"Setup Assistant Installer.exe\" has resource with unusual entropy \"RT_ICON:7.929536875330576\"\n \"Setup Assistant Installer.exe\" has resource with unusual entropy \"RT_ICON:7.871337849982223\"\n \"Setup Assistant Installer.exe\" has resource with unusual entropy \"RT_ICON:7.838266662133245\"\n \"Setup Assistant Installer.exe\" has resource with unusual entropy \"RT_ICON:7.765196784326772\"\n \"Setup Assistant Installer.exe\" has resource with unusual entropy \"RT_ICON:7.6231729523937695\"\n \"Setup Assistant Installer.exe\" has resource with unusual entropy \"RT_ICON:7.626804646181141\"\n \"Setup Assistant Installer.exe\" has resource with unusual entropy \"RT_ICON:7.40569718016963\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"Windows.ApplicationModel.Package::GetAppListEntriesAsync() at 42c097eadea8df11de34ff53db549777-600076a-AppActivationActivateAsyncd__0~MoveNext","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$3f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"StoreInstaller.Launcher::EnumProcessModules(System.IntPtr,System.IntPtr,System.UInt32,System.UInt32&) at 42c097eadea8df11de34ff53db549777-60002f5-Launcher~Main\n System.Diagnostics.Process::GetProcessById(System.Int32) at 42c097eadea8df11de34ff53db549777-60004ec-ParentProcessHelper~GetParentProcessName","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Setup Assistant Installer.exe\" claimed CRC 803797 while the actual is CRC 831422","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"Setup Assistant Installer.exe\" claims program is from Sun Apr 7 00:13:50 2052","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":40,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6aecec45140c8bcbd8088ba4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"Setup Assistant Installer.exe","analysis_start_time":"2026-11-05T20:51:18+00:00","indicators_count":{"informative":79,"suspicious":13,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}],"processes":[{"pid":628,"ppid":0,"name":"SetupAssistantInstaller.exe","command_line":"","sha256":"9cd7f951623eadcc479fdbf2453c02b83878c45980da4f16eb4bc10875d89027","normalized_path":"C:\\SetupAssistantInstaller.exe","uid":"00000000-00000628","icon":"$40"}],"all_imported_dlls":["kernel.appcore.dll","bcryptprimitives.dll","fltLib.dll","vcruntime140_1.dll","mscoreei.dll","vcruntime140_clr0400.dll","System.ni.dll","cryptsp.dll","ucrtbase.dll","imm32.dll","mscorlib.ni.dll","KernelBase.dll","msvcrt.dll","shlwapi.dll","msvcp_win.dll","vcruntime140.dll","kernel32.dll","version.dll","ucrtbase_clr0400.dll","System.Core.ni.dll","ntdll.dll","mscoree.dll","uxtheme.dll","oleaut32.dll","sechost.dll","user32.dll","clrjit.dll","psapi.dll","VxSSL64.dll","ole32.dll","combase.dll","advapi32.dll","rpcrt4.dll","bcrypt.dll","gdi32full.dll","ws2_32.dll","msvcp140.dll","clr.dll","win32u.dll","gdi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]},{"name":"SM0:628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aecec45140c8bcbd8088ba4"}]}]}},"report_ids":{"sandbox_job_ids":["6aecec45140c8bcbd8088ba4"]}}}]]}] 2c:[["$","title","0",{"children":"Sample 9cd7f951623e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 9cd7f951623e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9cd7f951623eadcc479fdbf2453c02b83878c45980da4f16eb4bc10875d89027"}],["$","meta","4",{"property":"og:title","content":"Sample 9cd7f951623e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 9cd7f951623e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9cd7f951623eadcc479fdbf2453c02b83878c45980da4f16eb4bc10875d89027"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 9cd7f951623e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 9cd7f951623e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]] 32:null