21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Barys.Generic Sample 9f761712b9eb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9f761712b9eb…. Malware family: Barys.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9f761712b9ebb6da0ba6a662c19cf802fcf2a1c7ba10a35a7890b6a8b8789ad9","keywords":["Malicious","Barys.Generic","malware analysis","sandbox report","threat intelligence","9f761712b9ebb6da0ba6a662c19cf802fcf2a1c7ba10a35a7890b6a8b8789ad9"],"about":{"@type":"SoftwareApplication","name":"9f761712b9ebb6da0ba6a662c19cf802fcf2a1c7ba10a35a7890b6a8b8789ad9.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"9f761712b9ebb6da0ba6a662c19cf802fcf2a1c7ba10a35a7890b6a8b8789ad9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Barys.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T408,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003384.00000000.162770.05760000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003384.00000000.162770.05760000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp")23:T1251,"" (Indicator: "GetDC"; Source: "00000000-00003384.00000000.162770.03130000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003384.00000000.162770.03130000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003384.00000000.162770.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003384.00000000.162770.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003384.00000000.162770.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003384.00000000.162770.03130000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003384.00000000.162770.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003384.00000000.162770.03130000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00003384.00000000.162770.05760000.00000004.mdmp, 00000000-00003384.00000000.162770.07B00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005384.00000000.163039.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005384.00000000.163039.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005384.00000000.163039.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005384.00000000.163039.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005384.00000000.163039.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005384.00000000.163039.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005384.00000000.163039.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005384.00000000.163039.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006244.00000000.163237.032A0000.00000004.mdmp")42:T5f6,Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; File: "00000000-00006244.00000000.163237.01071000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003384.00000000.162770.05760000.00000004.mdmp, 00000000-00003384.00000000.162770.07B00000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00003384.00000000.162770.05760000.00000004.mdmp, 00000000-00003384.00000000.162770.07B00000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00006244.00000000.163237.01071000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006244.00000000.163237.01089000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006244.00000000.163237.01089000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006244.00000000.163237.01089000.00000002.mdmp")43:T704,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003384.00000000.162770.03130000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005384.00000000.163039.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.02A8C000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.02A8C000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.02A8C000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006244.00000000.163237.032A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00006244.00000000.163237.032A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}-" (Indicator: "\Device\"; Source: "00000000-00006244.00000000.163237.032A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}-" (Indicator: "\DosDevices\"; Source: "00000000-00006244.00000000.163237.032A0000.00000004.mdmp")44:Tb40,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003384.00000000.162770.03130000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005384.00000000.163039.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$22","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00003384.00000000.162770.05760000.00000004.mdmp, 00000000-00003384.00000000.162770.07B00000.00000004.mdmp\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00003384.00000000.162770.05760000.00000004.mdmp, 00000000-00003384.00000000.162770.07B00000.00000004.mdmp\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003384.00000000.162770.05760000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003384.00000000.162770.07B00000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005384.00000000.163039.050C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$23","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$24","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00006244-50656-15-01079AC0\n SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00006244-50656-18-01079870","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00005384.00000000.163039.029E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00005384.00000000.163039.029E0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00005384.00000000.163039.029E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$25","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"9f761712b9ebb6da0ba6a662c19cf802fcf2a1c7ba10a35a7890b6a8b8789ad9.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00003384.00000000.162770.00BE2000.00000002.mdmp, 00000000-00003384.00000000.162770.05760000.00000004.mdmp, 00000000-00003384.00000000.162770.07B00000.00000004.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.72129","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$26","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006244-00000C2C-1522266183\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006244-00000C2C-1522266183\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00003384-00000C2C-1515148710\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003384-00000C2C-1514879144\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003384-00000C2C-1514879705\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006244.00000000.163237.01089000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.02A8C000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.02A8C000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.02A8C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005384-00000C2C-1526713092\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00006244.00000000.163237.032A0000.00000004.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00006244.00000000.163237.032A0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00003384.00000000.162770.05760000.00000004.mdmp, 00000000-00003384.00000000.162770.07B00000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageTimeout\" (Indicator: \"sendmessage\"; Source: \"00000000-00005384-00000C2C-1520735284\")\n Found reference to API \"SendMessageTimeoutA\" (Indicator: \"sendmessage\"; Source: \"00000000-00005384-00000C2C-1520735312\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003384.00000000.162770.03130000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005384.00000000.163039.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")\n Found string \"System.Data.Odbc\" (Indicator: \"System.Data.Odbc\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00006244.00000000.163237.01089000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00006244.00000000.163237.01089000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00006244.00000000.163237.01089000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00006244.00000000.163237.01089000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00003384.00000000.162770.05760000.00000004.mdmp, 00000000-00003384.00000000.162770.07B00000.00000004.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00003384.00000000.162770.05760000.00000004.mdmp, 00000000-00003384.00000000.162770.07B00000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"\" (Indicator: \"password\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")\n Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"md.exe /c ping 0 -n 2 & del \"\" (Indicator: \"ping\"; Source: \"00000000-00003384.00000000.162770.05760000.00000004.mdmp\n 00000000-00003384.00000000.162770.07B00000.00000004.mdmp\"), Found string \"md.exe /c ping 0 -n 2 & del \"\" (Indicator: \"ping\"; Source: \"00000000-00005384.00000000.163039.050C0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; File: \"00000000-00006244.00000000.163237.01071000.00000020.mdmp\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00005384.00000001.164957.029E0000.00000004.mdmp, 00000000-00005384.00000001.164957.050C0000.00000004.mdmp, 00000000-00005384.00000002.166879.029E0000.00000004.mdmp\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00006244.00000000.163237.01071000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00006244.00000000.163237.01089000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003384-00000C2C-1514662040\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005384-00000C2C-1526288665\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005384-00000C2C-1526688669\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005384-00000C2C-1526688693\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"youtuba.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005384)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$43","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005384.00000001.164957.050C0000.00000004.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006244.00000000.163237.01089000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006244.00000000.163237.032A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"CreateWellKnownSid\" (Indicator: \"CreateWellKnownSid\"; Source: \"00000000-00006244.00000000.163237.01089000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006244.00000000.163237.01089000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006244.00000000.163237.01089000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"youtuba.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6997effbc811ddef60052d65"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"