21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 25:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample a11312a75004… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a11312a75004…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a11312a75004f0107f1d83cbf5081072378854b1d3c00f0945d68293b18cea64","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","a11312a75004f0107f1d83cbf5081072378854b1d3c00f0945d68293b18cea64"],"about":{"@type":"SoftwareApplication","name":"2016-03-04-EITest-Angler-EK-payload-after-morningsidetennis.com.au.exe","applicationCategory":["peexe","executable"],"identifier":"a11312a75004f0107f1d83cbf5081072378854b1d3c00f0945d68293b18cea64","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T56b,"" wrote 32 bytes to a foreign process "2016_03_04_EITest_Angler_EK_payload_after_morningsidetennis.com.au.exe" (PID: 00003624) "" wrote 52 bytes to a foreign process "2016_03_04_EITest_Angler_EK_payload_after_morningsidetennis.com.au.exe" (PID: 00003624) "" wrote 4 bytes to a foreign process "2016_03_04_EITest_Angler_EK_payload_after_morningsidetennis.com.au.exe" (PID: 00003624) "" wrote 1024 bytes to a foreign process "2016_03_04_EITest_Angler_EK_payload_after_morningsidetennis.com.au.exe" (PID: 00003624) "" wrote 1 bytes to a foreign process "2016_03_04_EITest_Angler_EK_payload_after_morningsidetennis.com.au.exe" (PID: 00003624) "" wrote 1500 bytes to a foreign process "msiexec.exe" (PID: 00003712) "" wrote 4 bytes to a foreign process "msiexec.exe" (PID: 00003712) "" wrote 32 bytes to a foreign process "msiexec.exe" (PID: 00003712) "" wrote 52 bytes to a foreign process "msiexec.exe" (PID: 00003712) "" wrote 1500 bytes to a foreign process "msiexec.exe" (PID: 00004000) "" wrote 4 bytes to a foreign process "msiexec.exe" (PID: 00004000) "" wrote 32 bytes to a foreign process "msiexec.exe" (PID: 00004000) "" wrote 52 bytes to a foreign process "msiexec.exe" (PID: 00004000)23:T414,"" wrote bytes "4053ca775858cb77186acb77653ccc770000000000bf88760000000056cc8876000000007cca8876000000003768e4756a2ccc77d62dcc77000000002069e4750000000029a6887600000000a48de47500000000f70e887600000000" to virtual address "0x760E1000" (part of module "NSI.DLL") "msiexec.exe" wrote bytes "e990217388" to virtual address "0x77CB5C28" "msiexec.exe" wrote bytes "92e6c77779a8cc77be72cc77d62dcc771de2c77705a2cc77bee3c777616fcc776841ca770050ca7700000000ad3773768b2d7376b641737600000000" to virtual address "0x752D1000" "msiexec.exe" wrote bytes "e9c642cb89" to virtual address "0x76734889" "msiexec.exe" wrote bytes "4053ca775858cb77186acb77653ccc770000000000bf88760000000056cc8876000000007cca8876000000003768e4756a2ccc77d62dcc77000000002069e4750000000029a6887600000000a48de47500000000f70e887600000000" to virtual address "0x760E1000" "msiexec.exe" wrote bytes "7739c87779a8cc77be72cc77d62dcc771de2c77705a2cc77c868cb7757d1d277bee3c777616fcc776841ca770050ca7700000000ad3773768b2d7376b641737600000000" to virtual address "0x757F1000"24:Tb1c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAfoSURBVFhHrVcLUJTXFV4QFx8gQiKhRotoRIHwWOUNyy6vXdwHC+wCu+u+YF/AKqK4KCg/riWOj8RUTWpsmNCJz9SkNm2JOunUhoklj7ZjmjZtfbVxmtbBRmdMHc2Mk6/nX9y7qLutnXpnvrn/vd/+53z3nHPvf1fg8/kgoLbjdiOOzTTheJwdr02fAD/Pt2GhHQeibPhepA1D0XYM0XhIaGP8fprnsVfQgj0RFjwPi/858P7+qXbiLdgf5cbOG9Xw7T/m5/y+AwJ23VThRKwFb85y49AMN96IczMDP4xz4XCsGwf5+Rg3jhJej3Uy/lWhAzwORDv9v/loYTfeeqKd8adi9UgQzMatqAwMRTTDN3zqYQG+z4vhOy8mUH+BcKmEGfDP/eUeLvLcBAIr9I8vltBcIXxXynBiSh12Xqtk/PbLIty5dBWX/ibEvls1GPxBCAEjgkp8PEOMsenFeF9YgjFCwAE/ngyem8yPCYtpPIGz0SUYjeZtiNn7o/T8y+ll+GCWHG9HKjA4fPrhCPBh79tgR1e3A729HX4EBATGgb6n14OeHg/jN2xow2R417vg9boYz487u8l+nwcReVaqgXdDC+B6nVjt0EPfIENTg5wZMNCzQUvgez9k0DfKGG9qUsBkUMBKsKxUwWnVwm1rZLyzRYsujxHcgAeRy8zwvRwmAgM9TrTamqGuKYNSJmEGFDUSKFYQqFcry6BWlEGjljK+kcTp6qqg0xJInFGvgtVcz3ijQY02tx5cvwdTcozw7X0ndAQ2r7eha40d67sc8HYFq3w9PXspNd5uJ3rWuf2c225lDmJi0pCcUoLU1ErkLa+EVqPCGlpxIIXdnXZ0r7GB63MhMkdPAk6GFjCwwQmHvQn1qor7VlivkkJD0NaS8doKlBQVY05SDnOwpMaKdI0DGSvc+HZeE+KTpJiblM54i6keHrcB3GYPpmYZ4Nv3s3ACWuFs0UFFIVasKGUGVEoJatVlqJGVYu7TmUh+RgxNU3CF1Z425NvaUepoR1l7B0TGTsSkGoICzCp08AL62hCVrSMBI2F2gddC4W8lpWsoX53MgH88sIqiYIaozIl1GzlwHMd48RoOGXYOWW4OkvUcFMSVdgf5Bopor9cBbqMDwmcb4NvzkzAR6LGjxVqLyvJlkJQGQywtXw5xUQ7mLshFVlUtDEYd9IZglS+UrcTiGiOSK4xYIDPjWV0rSl0OJjBKIITFqKCFtUGYqSUBPw1ThN4WypUeLSYNLOZaZsBG4/zcaiyWmiDWN6GoZgWypcpgDchUSFdqJqAgqBqQo9Mz/tr1WBQsT6OoujEtvQ6+3T8OLaB/nQWdHSaqWCvtBgsz0EVzYjEZNXRC09cHeecmFLn6GC+nOTVB29+HBoK2vx9qQmAXfBWxGLNnzkRv10rMyOQFvB3mIOqxocWsQRmFv7Q4ixkoWJaBRWmFWFqhwlJZDeYXrsASqYLxyxrrUNRch2KdFpKmRlRYjZDagtt0SoIId2/fQYdThZj0Wvhe/FGYCHitWNW2kg6NZrQ7gznWquTILjSgQL8KmSoNEgtIRHFQQH69GmJCZb0KFQ21kBl0qDI0M4EzU8QYvzIOp0mOuEwS8PyJcLvARAL0VAfN8DiCBmxGDZbl1kGkWwv5Jg6ZLRxEzmCVW6nq2wlrCd576Ji0S+7OysC1L67CYZEjPl0D3wtvhjsHLFR8apRLRJAUZ7MVSErSkZKciqdFCmRUyZBSWI75+RWML1QpIdUoISeoKBINzQ1QEAI1cPW6EHfv3PKnIH6pkgS8FS4FZoqAAatdzehw6ZiB1e2NkEklmJehRUqFCfkGAzJrgwdNhVEPpVmPOkITwWxaSd+D4Pu/O3cF85JmoKdTj9mpcvh2Hg9ThJtM2NhtRL/XhL51JiZgQ7cNNpMaS9MkmCNyoaCdQ01/MAV6CncrgQ/7OgJ/SE0+qMb/8Tm0ylyacyB+SRV8u0JcyW4nKZElaUB6SR2hHpnUB0LYosyAXFmJ5bmliI3LQ2JeO4pXBwU0k0Mjga8FXghfB7aO4Db9+81oLM6RIafaiMvR1di6J0QKXhlNwL4zT2DvGb5PgG8knglwZX8CWZoATyYmYtrMWYiKSoVwfnAXGO455wU0ejkU1bpw/etk9v5L70bi5ffmYO97iRgaewo7XwoRgR27h8DDt/378G05gCPDQ8FvQf5ZtMf9AnO/+gJ/unAeBw8exvCrE3nk29fCDMTPE+PJlHJ8eTMBIyMfY9f2vYzfsfs1sj3M8J3ndjxcA4Fr8tnjuyC6cRiaaROnFd9ao95B/pe/RVrkbHzy0V/B36QDt2me3z64B7tfOIDvvvgKtg3ufIgP/H5y/9C1POCs41unwJX8Gpz8AhOQ+89PsXT6PAjuLsDRIyfJwZbgCu7d7x90EnAwWWjAB7tNT/5fwE8OLDyDgewPwVX+GVzWh0xA9rS5mPpNGg69cfq+1T0YiVAOHlkA98zPsSnjV+DKP8NmEmEVTNzd+RYVsQSvHxoJG9oHHU9e4SMLWLtkjFb+ewyIPoD5m9MQjX/KBBw9dv/K/xcHjyxgUdw47It+A1fUSYiunUNadCITEC7UjzUFd6cI8VTEDWT96zJyYlMwNSL1PgGhwvxYBYyOvo9zf/gM5/94kb5cEThybOLfy39qj0mAwO9oC22J5wYHsXXbDmwd3Mb2+X/L4f/L/xvX5O53y6w0fwAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"a11312a75004f0107f1d83cbf5081072378854b1d3c00f0945d68293b18cea64","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790281055548,"unified_at":"2026-09-24T20:17:35.548Z","metadata":{"hashes":{"sha256":"a11312a75004f0107f1d83cbf5081072378854b1d3c00f0945d68293b18cea64","sha1":"29a09f225ebfae2400655a8d9569f73b33e6d642","md5":"de713cd0d96f549ab948511077055f7c","sha512":"40ac25ec12542248d5088353efaac7f3b98a475c6eaedcfdb66de089dc77c0c187ba85f61250f80076a41d595a10df899289af703fb9e92a895ae434c95fee32","ssdeep":"3072:XtoeBY/5hdJDvqLTlMZWR8MhIad+LT8vhJ:K3dJmLgW/cLQJ","ssdeep_chunks":["3072:XtoeBY/","3072:toeBY/5","3072:oeBY/5h","3072:eBY/5hd","3072:BY/5hdJ","3072:Y/5hdJD","3072:/5hdJDv","3072:5hdJDvq","3072:hdJDvqL","3072:dJDvqLT","3072:JDvqLTl","3072:DvqLTlM","3072:vqLTlMZ","3072:qLTlMZW","3072:LTlMZWR","3072:TlMZWR8","3072:lMZWR8M","3072:MZWR8Mh","3072:ZWR8MhI","3072:WR8MhIa","3072:R8MhIad","3072:8MhIad+","3072:MhIad+L","3072:hIad+LT","3072:Iad+LT8","3072:ad+LT8v","3072:d+LT8vh","3072:+LT8vhJ","6144:XtoeBY/","6144:toeBY/5","6144:oeBY/5h","6144:eBY/5hd","6144:BY/5hdJ","6144:Y/5hdJD","6144:/5hdJDv","6144:5hdJDvq","6144:hdJDvqL","6144:dJDvqLT","6144:JDvqLTl","6144:DvqLTlM","6144:vqLTlMZ","6144:qLTlMZW","6144:LTlMZWR","6144:TlMZWR8","6144:lMZWR8M","6144:MZWR8Mh","6144:ZWR8MhI","6144:WR8MhIa","6144:R8MhIad","6144:8MhIad+","6144:MhIad+L","6144:hIad+LT","6144:Iad+LT8","6144:ad+LT8v","6144:d+LT8vh","6144:+LT8vhJ","3072:K3dJmLg","3072:3dJmLgW","3072:dJmLgW/","3072:JmLgW/c","3072:mLgW/cL","3072:LgW/cLQ","3072:gW/cLQJ"],"imphash":"ed3e659072445506b1a9e12fd4645e99"},"file_info":{"file_name":"2016-03-04-EITest-Angler-EK-payload-after-morningsidetennis.com.au.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":114688,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499289681000,"last_seen":1677528020000,"last_multi_scan":1677528020000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":17,"malicious_count":8,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.tp5G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1225549","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.PonyStealer.hm0@oqu!Yqab","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Emotet-6351047-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Gamarue.FKCI-8942","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.PonyStealer.hm0@oqu!Yqab (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrojanDownloader.Wauchos.BD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!45656D973F654746","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 0055e3da1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.Win32.Agent.hgph","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FIAA!DE713CD0D96F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dwn.eawdzr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"BKDR_HPTOFSEE.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"BKDR_HPTOFSEE.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.AGEA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDownloader.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Wauchos.Win32.92","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"%WINDIR%\\SYSTEM32\\APPHELP.DLL\" at base 75BC0000\n \"\" loaded module \"NTDLL\" at base 77B70000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"}]},{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"\" loaded module \"%WINDIR%\\system32\\MSVBVM60.DLL\" at 72940000","origin":"Loaded Module","id":"module-0","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"},{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"NtWriteVirtualMemory@ntdll.dll\"\n \"NtUnmapViewOfSection@ntdll.dll\"\n \"NtGetContextThread@ntdll.dll\"\n \"NtSetContextThread@ntdll.dll\"\n \"NtResumeThread@ntdll.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" (UID: 00135765-00003712)\n Spawned process \"msiexec.exe\" (UID: 00141531-00003744)\n Spawned process \"msiexec.exe\" (UID: 00144750-00003760)\n Spawned process \"msiexec.exe\" (UID: 00147781-00003788)\n Spawned process \"msiexec.exe\" (UID: 00150953-00003816)\n Spawned process \"msiexec.exe\" (UID: 00154046-00003848)\n Spawned process \"msiexec.exe\" (UID: 00156859-00003868)\n Spawned process \"msiexec.exe\" (UID: 00160453-00003892)\n Spawned process \"msiexec.exe\" (UID: 00163375-00003932)\n Spawned process \"msiexec.exe\" (UID: 00167015-00003964)\n Spawned process \"msiexec.exe\" (UID: 00169859-00003984)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"},{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"Z:\\\" at 00130687-00003624-77BB6268-135187","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"Z:\\\" at 00130687-00003624-77BB6268-135187","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to create a remote thread (often used for process injection)","description":"CreateRemoteThread@KERNEL32.DLL at 00123656-00003584-77BD228D-130645","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-5","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Sample translates to unusual binary language","description":"Simplified Chinese (ID: 0x0804)","origin":"Static Parser","relevance":10,"id":"static-8","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"},{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/56 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"},{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"2016_03_04_EITest_Angler_EK_payload_after_morningsidetennis.com.au.exe\" (Protection: \"read/write\")\n \"\" allocated 00032768 bytes of memory in \"2016_03_04_EITest_Angler_EK_payload_after_morningsidetennis.com.au.exe\" (Protection: \"execute/read/write\")\n \"\" allocated 00001500 bytes of memory in \"msiexec.exe\" (Protection: \"read/write\")\n \"\" allocated 00000088 bytes of memory in \"msiexec.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$22","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtWriteVirtualMemory@NTDLL.DLL at 00123656-00003584-77BD228D-130503\n NtUnmapViewOfSection@NTDLL.DLL at 00123656-00003584-77BD228D-130519\n NtGetContextThread@NTDLL.DLL at 00123656-00003584-77BD228D-130578\n NtSetContextThread@NTDLL.DLL at 00123656-00003584-77BD228D-130627\n NtResumeThread@NTDLL.DLL at 00123656-00003584-77BD228D-133203","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00123656-00003584)\n Spawned process \"\" (UID: 00130687-00003624)\n Spawned process \"msiexec.exe\" (UID: 00135765-00003712)\n Spawned process \"msiexec.exe\" (UID: 00141531-00003744)\n Spawned process \"msiexec.exe\" (UID: 00144750-00003760)\n Spawned process \"msiexec.exe\" (UID: 00147781-00003788)\n Spawned process \"msiexec.exe\" (UID: 00150953-00003816)\n Spawned process \"msiexec.exe\" (UID: 00154046-00003848)\n Spawned process \"msiexec.exe\" (UID: 00156859-00003868)\n Spawned process \"msiexec.exe\" (UID: 00160453-00003892)\n Spawned process \"msiexec.exe\" (UID: 00163375-00003932)\n Spawned process \"msiexec.exe\" (UID: 00167015-00003964)\n Spawned process \"msiexec.exe\" (UID: 00169859-00003984)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"\" (Thread ID: 2156) slept \"220\" times (threshold: 200)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui\"\n \"\" created file \"%WINDIR%\\system32\\netmsg.dll\"\n \"\" created file \"%WINDIR%\\Fonts\\staticcache.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/54 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"europe.pool.ntp.org\"\n \"kelotragerofgerome.com\"\n \"donepreliminatories.com\"\n \"lepricongoldcoinmine.com\"\n \"mcpredictionorganizations.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"188.39.213.7:123\"\n \"107.181.174.240:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"msjnojemf.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /www/ HTTP/1.1\nCache-Control: no-cache\nConnection: close\nPragma: no-cache\nContent-Type: application/octet-stream\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 65\nHost: lepricongoldcoinmine.com\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 188.39.213.7\"","origin":"Network Traffic","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"msjnojemf.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"107.181.174.240\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$23","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TROJAN Zeus GameOver Possible DGA NXDOMAIN Responses\" (SID: 2018316, Rev: 4, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")","origin":"Registry Access","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 5 domains and 5 hosts"}],"sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]}]},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":69,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":17,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":5,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"58455c4aaac2ed1d7adb573c","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["GBR","NLD","USA"],"submit_name":"2016-03-04-EITest-Angler-EK-payload-after-morningsidetennis.com.au.exe","analysis_start_time":"2016-12-05T13:25:09+00:00","indicators_count":{"informative":8,"suspicious":12,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"56d9d97eaac2ed7c0868e8a2","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":67,"malware_family":"Dropper.VB","submit_name":"2016-03-04-EITest-Angler-EK-payload-after-morningsidetennis.com.au.exe","analysis_start_time":"2016-03-06T17:44:02+00:00","indicators_count":{"informative":2,"suspicious":6,"malicious":3},"is_in_unified_schema":true},{"id":"56d9d97eaac2ed7c0868e8a0","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":52,"malware_family":"QVM03.0.Malware","submit_name":"2016-03-04-EITest-Angler-EK-payload-after-morningsidetennis.com.au.exe","analysis_start_time":"2016-03-04T12:53:15+00:00","indicators_count":{"informative":4,"suspicious":6,"malicious":6},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"188.39.213.7","port":123,"protocol":"UDP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"address":"107.181.174.240","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]}],"dns_resolutions":[{"domain":"europe.pool.ntp.org","address":"188.166.12.29","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"domain":"kelotragerofgerome.com","country":"-","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"domain":"donepreliminatories.com","country":"-","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"domain":"lepricongoldcoinmine.com","address":"107.181.174.240","country":"United States","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"domain":"mcpredictionorganizations.com","country":"-","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]}],"http_requests":[{"host":"107.181.174.240","host_ip":"107.181.174.240:80","url":"/www/","method":"POST","header":"POST /www/ HTTP/1.1\nCache-Control: no-cache\nConnection: close\nPragma: no-cache\nContent-Type: application/octet-stream\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 65\nHost: lepricongoldcoinmine.com","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"}],"processes":[{"pid":3584,"ppid":0,"name":"2016_03_04_EITest_Angler_EK_payload_after_morningsidetennis.com.au.exe","command_line":"","normalized_path":"","uid":"00123656-00003584","icon":"$24"},{"pid":3624,"ppid":0,"name":"2016_03_04_EITest_Angler_EK_payload_after_morningsidetennis.com.au.exe","command_line":"","normalized_path":"","uid":"00130687-00003624"},{"pid":3712,"ppid":0,"name":"msiexec.exe","command_line":"","normalized_path":"","uid":"00135765-00003712"},{"pid":3744,"ppid":0,"name":"msiexec.exe","command_line":"","normalized_path":"","uid":"00141531-00003744"},{"pid":3760,"ppid":0,"name":"msiexec.exe","command_line":"","normalized_path":"","uid":"00144750-00003760"},{"pid":3788,"ppid":0,"name":"msiexec.exe","command_line":"","normalized_path":"","uid":"00147781-00003788"},{"pid":3816,"ppid":0,"name":"msiexec.exe","command_line":"","normalized_path":"","uid":"00150953-00003816"},{"pid":3848,"ppid":0,"name":"msiexec.exe","command_line":"","normalized_path":"","uid":"00154046-00003848"},{"pid":3868,"ppid":0,"name":"msiexec.exe","command_line":"","normalized_path":"","uid":"00156859-00003868"},{"pid":3892,"ppid":0,"name":"msiexec.exe","command_line":"","normalized_path":"","uid":"00160453-00003892"}],"all_imported_dlls":["IMM32.DLL","MSVBVM60.DLL","MSCTF.dll","ntdll.dll","shell32.dll","MPR.dll","USERENV.dll","KERNELBASE.dll","ADVAPI32.dll","RPCRT4.dll","apphelp.dll","ws2_32.dll","sfc.dll","iertutil.dll","profapi.dll","kernel32.dll","SHELL32.dll","MSACM32.dll","CRYPT32.dll","urlmon.dll","MSASN1.dll","GDI32.dll","winhttp.dll","dnsapi.dll","WININET.dll","SHLWAPI.dll","SspiCli.dll","VERSION.dll","DEVOBJ.dll","msvcrt.dll","OLEAUT32.dll","crypt32.dll","AcLayers.DLL","sfc_os.DLL","sechost.dll","LPK.dll","CFGMGR32.dll","USER32.dll","dwmapi.dll","WINMM.dll","AcGenral.DLL","UxTheme.dll","USP10.dll","samcli.dll","msi.dll","ole32.dll","SETUPAPI.dll","PSAPI.DLL","CRYPTBASE.dll","uxtheme.dll","SXS.DLL","KernelBase.dll","user32.dll","lpk.dll","oleaut32.dll","imm32.dll","msvbvm60.dll","gdi32.dll","advapi32.dll","cryptbase.dll","version.dll","usp10.dll","rpcrt4.dll","sxs.dll","msctf.dll","clbcatq.dll","shlwapi.dll","rpcss.dll","nsi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"msjnojemf.exe","sha256":"a11312a75004f0107f1d83cbf5081072378854b1d3c00f0945d68293b18cea64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]}],"files_written":[{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"%SAMPLEDIR%\\2016_03_04_EITest_Angler_EK_payload_after_morningsidetennis.com.au.exe","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"}]},{"path":"%WINDIR%\\system32\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a0"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"},{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"%WINDIR%\\system32\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56d9d97eaac2ed7c0868e8a2"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"C:\\2016_03_04_EITest_Angler_EK_payload_after_morningsidetennis.com.au.exe","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.DLL","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"%WINDIR%\\system32\\en-US\\msiexec.exe.mui","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"%PROGRAMFILES(X86)%\\3801429","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"C:\\2016_0~1.EXE\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"%PROGRAMFILES(X86)%\\msjnojemf.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"%PROGRAMFILES(X86)%\\msjnojemf.exe","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"path":"%PROGRAMFILES(X86)%\\msjnojemf.exe:1219216852","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\\","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\ADVANCED\\","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"key":"HKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\1055822078\\1055822078","sources":[{"report_type":"sandbox","report_id":"58455c4aaac2ed1d7adb573c"}]}]},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["58455c4aaac2ed1d7adb573c","56d9d97eaac2ed7c0868e8a2","56d9d97eaac2ed7c0868e8a0"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample a11312a75004… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a11312a75004…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a11312a75004f0107f1d83cbf5081072378854b1d3c00f0945d68293b18cea64"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample a11312a75004… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a11312a75004…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a11312a75004f0107f1d83cbf5081072378854b1d3c00f0945d68293b18cea64"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample a11312a75004… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a11312a75004…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L25","11",{}]]