24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T412,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample a131edf272f1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a131edf272f1…. Threat score 100/100. 10/27 AV engines flagged this file. 4 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a131edf272f1df1c841a9c457a50011325b1e22e950d62c5e78d3060450e6b93","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","a131edf272f1df1c841a9c457a50011325b1e22e950d62c5e78d3060450e6b93"],"about":{"@type":"SoftwareApplication","name":"Box.lnk","applicationCategory":["lnk"],"identifier":"a131edf272f1df1c841a9c457a50011325b1e22e950d62c5e78d3060450e6b93","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T789,"mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")26:T417,"mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB")27:T59d,"mshta.exe" touched "WinInetBroker Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "mshta.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\INPROCHANDLER") "mshta.exe" touched "Network List Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "mshta.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\INPROCSERVER32") "mshta.exe" touched "Microsoft HTA Document 6.0" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3050F5C8-98B5-11CF-BB82-00AA00BDCE0B}") "mshta.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\INPROCSERVER32") "mshta.exe" touched "Browser Application State" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\PROGID") "mshta.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "mshta.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\PROGID") "mshta.exe" touched "Microsoft Url History Service" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "mshta.exe" touched "NetworkListManager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS")28:T67d,"cmd.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\JANWMBN8.txt" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0CH0OVJV\3ikRRIb[1].htm" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\98FKNM2M\ED4B4B67839C89883DD0BCD462FDA54E96FB79ED[1].svg" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VC2ME0V4\53B03BEE40C746E8FC70731BA2B6902C0FA65CEA[1].svg" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "mshta.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "mshta.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\JANWMBN8.txt" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\98FKNM2M\ED4B4B67839C89883DD0BCD462FDA54E96FB79ED[1].svg" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\VC2ME0V4\53B03BEE40C746E8FC70731BA2B6902C0FA65CEA[1].svg"29:T1686," Warning! | There might be a problem with the requested link

Warning: This URL has been blocked by Bitly's systems as potentially harmful.

We recommend you close your browser window and notify the person who sent you the link.

Why was this link blocked?

Bitly displays this warning when a link has been blocked. There are many reasons why a link may be blocked:

The link may be listed on a website blocklisting service.
The link may have been reported to Bitly by a member of the public.
The link may contain malware (software designed to harm your computer), attempt to collect your personal information for nefarious purposes, or otherwise contain harmful and/or illegal content.
The link may be attempting to hide the final destination.
The link may lead to a forgery of another website or may infringe the rights of others.

If you believe this link has been blocked in error, please contact Bitly via this form.

" (Indicator: "https://") "" (Indicator: "https://")2a:T4d5,"cmd.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "cmd.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\outllib.dll" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\outllib.dll.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\system32\mshta.exe.Local\" "mshta.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\OUTLLIB.DLL" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\OUTLLIB.DLL.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\System32\MSHTA.EXE.LOCAL"2b:T8a1,"mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")2c:T657,"cmd.exe" wrote bytes "e952332eff" to virtual address "0xFF87DC00" ("AdjustTokenPrivileges@ADVAPI32.DLL") "cmd.exe" wrote bytes "e9f02e29ff" to virtual address "0xFF8CE020" ("CredEnumerateA@ADVAPI32.DLL") "cmd.exe" wrote bytes "e9e02f29ff" to virtual address "0xFF8CDEF0" ("CredEnumerateW@ADVAPI32.DLL") "mshta.exe" wrote bytes "e9ae0a93ff" to virtual address "0xFF2103E0" (part of module "WININET.DLL") "mshta.exe" wrote bytes "e90e0c93ff" to virtual address "0xFF210240" (part of module "WININET.DLL") "mshta.exe" wrote bytes "e99eaf4101" to virtual address "0xFD725D70" (part of module "URLMON.DLL") "mshta.exe" wrote bytes "e9e05f80ff" to virtual address "0xFF33AE30" (part of module "WININET.DLL") "mshta.exe" wrote bytes "e9ae428fff" to virtual address "0xFF24CB20" (part of module "WININET.DLL") "mshta.exe" wrote bytes "e99e293901" to virtual address "0xFD7AE3B0" (part of module "URLMON.DLL") "mshta.exe" wrote bytes "e9f8266002" to virtual address "0xFC53E558" (part of module "IPHLPAPI.DLL") "mshta.exe" wrote bytes "e90ec0f5ff" to virtual address "0x00CC4F80" "mshta.exe" wrote bytes "e91eb38eff" to virtual address "0xFF255A70" (part of module "WININET.DLL") "mshta.exe" wrote bytes "e99249f6ff" to virtual address "0x00CBC63C" "mshta.exe" wrote bytes "e97ee14bff" to virtual address "0xFF682D50" (part of module "GDI32.DLL") "mshta.exe" wrote bytes "e901b5f5ff" to virtual address "0x00CC5A50" "mshta.exe" wrote bytes "e900750b01" to virtual address "0xFDA89794" (part of module "SHELL32.DLL") "mshta.exe" wrote bytes "e9840ce700" to virtual address "0xFDCD0050" (part of module "SHELL32.DLL")2d:T6e9,"cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-MX") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-MX") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PT-PT") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PT-PT") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-CA") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-CA") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EU-ES") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EU-ES") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "SL-SI") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "SL-SI") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "TR-TR") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "TR-TR") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "SV-SE")2e:T574,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD3klEQVR42u2XbUxTVxjHm5EgiQskMAdkaF+wIQFGwiAIQSISxgApQxFm/LKPy0xcMibGLVOZU4pA1lL7Jvph84OJbuoHzV4SM4QQNu0LbSlwazJGq2FqwdClNrXU/H3ONa1WQQUv8sV/8s/NOffc8/zO85x7bisSvdFKS9mlwneHO16rD7d3IgrQ3tEJbmIK9vF/yROC+rN9PfNeGUQU4Ae1Flab/bGH7bDMaxssVhvMUQ/DZHlk1s+es9ps/Dh2n/VfM1tx1WTB39fM+OuqKeoYAL3hJOrr63krFArU1dWhtrYW1dXVqKqqQmVlJSoqKlBeXo6ysjKUlpaipKQERUVFKCgoQH5+PvLy8pCbm4vs7GxkZWVBLpdDIpEgPT0dycnJSEhIwJNlfwrgxMoC6PS9Kwug1R9/BiCihQCYlg2AKZIBpggA07IA9GgNCwI8LwNMEYCcnBxkZmZCKpVCLBYjIyMDKSkpSEpKQmJiIuLj44UBKC4u5lcqk8miEHFxcVjs4ffSAEwsKFsZ09MTzde3aAD1Mf2Cm5Cl73kTPQmAF2hBAFWPLgagsLDwmU0jtGIAWvd9iz17Wpfk5h07X70EbKIpnw8O9w0MT3jwj9v9UvZ6vTyEIAC2SQ/6LBwGbRxadX9gdWU30uo1WP/Jcch3GKNOb9BCTn3jLhcmJyeFA7C7PfjTzKGfIGxOJwznhiBp0iHtYw3WNRqwbruOrMc7W9QQN2gwxgkM4CCAKzyAC4N2gqDPaov2dyTXqCBuMhDMI68hgMxtKuEzwAD6rS4MkEdGR3HqNxOkTUaItz8OLmk24l0eQC08wIjHwwc3U/CL/XZk7ezF2kYdBTbywddu1eK9hmOUARXWE4DgJXASwJCDI4Ax1LScwRqFBrJmA5/+NIUaqTVdVHs1Vm9WQtawDCUYIwALrf7ny1akKnogpXRHgr9V3AbdmSu4cNkE0YYDSP2oQ3gAjgCcBNDxUx+SqlU8AEt5XEkbDhp+hZPeDObecwNI3HRI+BK4CGCUANp/7MPbH3bT5tNj1aYj2KU8zwd2cBwc4xw/5uQvA3wG3HQYCQZwa9aH/+hkuzR0HasquqgMGqRR3a97bsE7PQ3PnWncvD2NKe8M374zM4NZOj3Zs9/Tb/z2o9042q2CslOFI8ouHHrB/4Ivv9obC+Cfm4PXfx++YBAbPz8F0fvf4INPjQhS20++6w9gluwj/38vAH8giFAotOQMxIhNEnzwAN57YdwPh3F7NoCte09DVLQfjV+fxeDITQSoPxAKIzhHY8ghaofJggEwhbF4CQKw+4uWJX+O97e1vTLAQ7mC7y9PtZ6hAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a131edf272f1df1c841a9c457a50011325b1e22e950d62c5e78d3060450e6b93","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790802950147,"unified_at":"2026-09-30T21:15:50.147Z","metadata":{"hashes":{"sha256":"a131edf272f1df1c841a9c457a50011325b1e22e950d62c5e78d3060450e6b93","sha1":"818971100926c40fb962b0fe3948134215a1a994","md5":"1c6fe96c5a36012876824f035a213af5","sha512":"6e449c6daa683554e46c0dd2f29f0f353eee1ae0cb14f53e28d3737b0f5f4af715c48c3ba5c1c9ec583b1e17bfb83c1dfea37f8415747f914cb8140040f35dd3","ssdeep":"12:8AlX30m/3BVSXzZUBW+f2piumZ8iNL4t2Ytdy1CIK:8A3J/ByUA+fbnZ555n","ssdeep_chunks":["12:8AlX30m","12:AlX30m/","12:lX30m/3","12:X30m/3B","12:30m/3BV","12:0m/3BVS","12:m/3BVSX","12:/3BVSXz","12:3BVSXzZ","12:BVSXzZU","12:VSXzZUB","12:SXzZUBW","12:XzZUBW+","12:zZUBW+f","12:ZUBW+f2","12:UBW+f2p","12:BW+f2pi","12:W+f2piu","12:+f2pium","12:f2piumZ","12:2piumZ8","12:piumZ8i","12:iumZ8iN","12:umZ8iNL","12:mZ8iNL4","12:Z8iNL4t","12:8iNL4t2","12:iNL4t2Y","12:NL4t2Yt","12:L4t2Ytd","12:4t2Ytdy","12:t2Ytdy1","12:2Ytdy1C","12:Ytdy1CI","12:tdy1CIK","24:8AlX30m","24:AlX30m/","24:lX30m/3","24:X30m/3B","24:30m/3BV","24:0m/3BVS","24:m/3BVSX","24:/3BVSXz","24:3BVSXzZ","24:BVSXzZU","24:VSXzZUB","24:SXzZUBW","24:XzZUBW+","24:zZUBW+f","24:ZUBW+f2","24:UBW+f2p","24:BW+f2pi","24:W+f2piu","24:+f2pium","24:f2piumZ","24:2piumZ8","24:piumZ8i","24:iumZ8iN","24:umZ8iNL","24:mZ8iNL4","24:Z8iNL4t","24:8iNL4t2","24:iNL4t2Y","24:NL4t2Yt","24:L4t2Ytd","24:4t2Ytdy","24:t2Ytdy1","24:2Ytdy1C","24:Ytdy1CI","24:tdy1CIK","12:8A3J/By","12:A3J/ByU","12:3J/ByUA","12:J/ByUA+","12:/ByUA+f","12:ByUA+fb","12:yUA+fbn","12:UA+fbnZ","12:A+fbnZ5","12:+fbnZ55","12:fbnZ555","12:bnZ555n"],"imphash":"Unknown"},"file_info":{"file_name":"Box.lnk","file_type":["lnk"],"file_type_id":"file link","file_size":744,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1669838125000,"last_seen":1677851423000,"last_multi_scan":1677851423000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":16},"sandbox_signatures":{"informative_count":29,"suspicious_count":21,"malicious_count":4,"total":54},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"LNK/Dldr.Agent.VPLK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Heur.BZC.YAX.Nioc.1.0E6EDBDF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Heur.BZC.YAX.Nioc.1.0E6EDBDF (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"LNK/NukeSped.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.WinLNK.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"BlueNoroff!lnk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DownLnk-X","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.86DC7766","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.86DC7766","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.NukeSped.Script.40","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Defense Evasion","technique":"Mshta","attack_id":"T1218.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/005","identifiers":[{"type":"malicious","value":"Detected MSHTA process execution"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Calls an API's typically used for searching a directory for a files"},{"type":"suspicious","value":"Tries to access non-existent files"},{"type":"suspicious","value":"Touches files in program files directory"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Calls an API typically get system version information"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\micross.ttf\" at 00000000-00002756-00000046-26826557\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\micross.ttf\" at 00000000-00002756-00000046-26864662\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\arial.ttf\" at 00000000-00002756-00000046-27027522\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\arialbd.ttf\" at 00000000-00002756-00000046-27053231\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\wingding.ttf\" at 00000000-00002756-00000046-27077508\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\wingding.ttf\" at 00000000-00002756-00000046-27084416","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"mshta.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00002756)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\M1bgQEl\\AppData\\Local\\Microsoft\\Windows\\History (UID: 00000000-00002756)","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"mshta https://bit.ly/3ikRRIb\" - (UID: 00000000-00003344)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"67.199.248.10:443\"\n \"13.32.176.6:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"!IECompat!Mutex\"\n \"Local\\MSIMGSIZECacheMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"ED4B4B67839C89883DD0BCD462FDA54E96FB79ED_1_.svg\" as clean (type is \"SVG Scalable Vector Graphics image\")\n Antivirus vendors marked dropped file \"53B03BEE40C746E8FC70731BA2B6902C0FA65CEA_1_.svg\" as clean (type is \"SVG Scalable Vector Graphics image\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"target=\"_blank\" rel=\"noopener noreferrer\"\" (Indicator: \"open\")\n \"MaxConnectionsPerServer\" (Indicator: \"MaxConnectionsPerServer\")\n \"MaxConnectionsPer1_0Server\" (Indicator: \"MaxConnectionsPer1_0Server\")\n \"ThemeApiConnectionRequest\" (Indicator: \"ThemeApiConnectionRequest\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"mshta.exe\" (UID: 00000000-00002756) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"mshta.exe\" (UID: 00000000-00002756) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bit.ly\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"References url in command line","description":"Process \"cmd.exe\" with commandline \"/c start /b mshta https://bit.ly/3ikRRIb\" (UID: 00000000-00003344)\n Process \"mshta.exe\" with commandline \"mshta https://bit.ly/3ikRRIb\" (UID: 00000000-00002756)","origin":"Monitored Target","id":"target-174","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"mshta.exe\" with commandline \"mshta https://bit.ly/3ikRRIb\" (UID: 00000000-00002756)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"mshta.exe\" with commandline \"mshta https://bit.ly/3ikRRIb\" (UID: 00000000-00002756)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"mshta.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"ED4B4B67839C89883DD0BCD462FDA54E96FB79ED_1_.svg\" has type \"SVG Scalable Vector Graphics image\"- [targetUID: 00000000-00003344]\n \"53B03BEE40C746E8FC70731BA2B6902C0FA65CEA_1_.svg\" has type \"SVG Scalable Vector Graphics image\"- [targetUID: 00000000-00003344]\n \"JANWMBN8.txt\" has type \"ASCII text\"- Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\JANWMBN8.txt]- [targetUID: 00000000-00002756]\n \"3ikRRIb_1_.htm\" has type \"HTML document ASCII text\"- [targetUID: 00000000-00003344]\n \"urlref_httpsbit.ly3ikRRIb\" has type \"HTML document ASCII text\"- [targetUID: 00000000-00003344]","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://d1ayxb9ooonjts.cloudfront.net/d/C88681CBA60CE9321C6FD2FD8DC97555992FA1A3.png\"\n Pattern match: \"https://bitly.com/\"\n Pattern match: \"https://d1ayxb9ooonjts.cloudfront.net/d/ED4B4B67839C89883DD0BCD462FDA54E96FB79ED.svg\"\n Pattern match: \"https://docs.google.com/forms/d/e/1FAIpQLSczQXuQ-l1jv8yQETGyw7BYoi-k_8CRKVOqywntj4AykJgpvA/viewform\"\n Heuristic match: \"bit.ly\"\n Pattern match: \"https://bit.ly/3ikRRIb\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 67.199.248.10 on port 443\"\n \"HTTPS traffic to 13.32.176.6 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"mshta.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"AdjustTokenPrivileges@ADVAPI32.DLL\" in \"cmd.exe\"\n \"CredEnumerateA@ADVAPI32.DLL\" in \"cmd.exe\"\n \"CredEnumerateW@ADVAPI32.DLL\" in \"cmd.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"mshta.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"JANWMBN8.txt\" - Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\JANWMBN8.txt]- [targetUID: 00000000-00002756]","origin":"Binary File","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"mshta.exe\" is protecting memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically get system version information","description":"\"cmd.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003344)\n \"mshta.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"mshta.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00002756)\n \"mshta.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"3/91 reputation engines marked \"https://bit.ly\" as malicious (3% detection rate)\n 3/91 reputation engines marked \"http://bit.ly\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"28/61 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\mshta.exe\" (Handle: 140)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\mshta.exe\" (Handle: 140)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\mshta.exe\" (Handle: 140)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 67.199.248.10 on port 443 is sent without HTTP header\n TCP traffic to 13.32.176.6 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"mshta.exe\" called \"GetAsyncKeyState\"\n \"mshta.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003344)\n \"mshta.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"mshta.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"mshta.exe\" called \"FindFirstFileW\" (UID: 00000000-00002756)\n \"mshta.exe\" called \"FindNextFileW\" (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Touches files in program files directory","description":"\"mshta.exe\" trying to touch file \"%PROGRAMFILES%\\Microsoft Office\\Office14\\OUTLLIB.DLL\"\n \"mshta.exe\" trying to touch file \"%PROGRAMFILES%\\Microsoft Office\\Office14\\OUTLLIB.DLL.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$2a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Detected MSHTA process execution","description":"Process \"mshta.exe\" with commandline \"mshta https://bit.ly/3ikRRIb\" (UID: 00000000-00002756)","origin":"Monitored Target","mitre_attack_id":"T1218.005","relevance":10,"id":"target-113","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"28/61 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"PDF file referenced an URL that was taken down due to TOS violation","description":"\"Warning! | There might be a problem with the requested link\" (Indicator: \"there might be a problem with the requested link\"; Context: \"https://bit.ly/3ikRRIb\")","origin":"File/Memory","relevance":10,"id":"string-26","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]}],"incidents":[{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Detected MSHTA process execution"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":91,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6387b52cea66ef2ec417cc7d","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Heur.BZC.YAX.Nioc.1","contacted_countries":["USA"],"submit_name":"Box.lnk","analysis_start_time":"2022-11-30T19:55:26+00:00","indicators_count":{"informative":29,"suspicious":26,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"67.199.248.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"address":"13.32.176.6","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]}],"dns_resolutions":[{"domain":"bit.ly","address":"67.199.248.10","ttl":119,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}],"processes":[{"pid":3344,"ppid":0,"name":"cmd.exe","command_line":"/c start /b mshta https://bit.ly/3ikRRIb","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00003344","icon":"$2e"},{"pid":2756,"ppid":3344,"name":"mshta.exe","command_line":"mshta https://bit.ly/3ikRRIb","sha256":"8c10ae4be93834a4c744f27ca79736d9123ed9b0d180db28556d2d002545baf2","normalized_path":"%WINDIR%\\system32\\mshta.exe","parent_uid":"00000000-00003344","uid":"00000000-00002756"}],"all_imported_dlls":["ole32.dll","ws2_32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","sechost.dll","gpapi.dll","msls31.dll","ntdll.dll","lpk.dll","msctf.dll","oleacc.dll","api-ms-win-downlevel-version-l1-1-0.dll","profapi.dll","kernel32.dll","usp10.dll","dhcpcsvc6.dll","oleaccrc.dll","dnsapi.dll","rasadhlp.dll","ieframe.dll","RpcRtRemote.dll","shlwapi.dll","uxtheme.dll","clbcatq.dll","msimtf.dll","npmproxy.dll","secur32.dll","netprofm.dll","nlaapi.dll","rpcrt4.dll","mshtml.dll","dwmapi.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","IPHLPAPI.DLL","DWrite.dll","userenv.dll","comctl32.dll","ncrypt.dll","wintrust.dll","winbrand.dll","nsi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","rsaenh.dll","apphelp.dll","winhttp.dll","mswsock.dll","cryptsp.dll","WindowsCodecs.dll","msvcrt.dll","imm32.dll","WSHTCPIP.DLL","urlmon.dll","webio.dll","bcrypt.dll","cfgmgr32.dll","cryptbase.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","credssp.dll","bcryptprimitives.dll","d2d1.dll","mlang.dll","KernelBase.dll","gdi32.dll","fltLib.dll","api-ms-win-core-synch-l1-2-0.dll","oleaut32.dll","devobj.dll","normaliz.dll","wininet.dll","VxSSL64.dll","shell32.dll","version.dll","winnsi.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","wshqos.dll","dxgi.dll","d3d11.dll","dhcpcsvc.dll","FWPUCLNT.DLL","setupapi.dll","sspicli.dll","msasn1.dll","d3d10warp.dll","advapi32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","crypt32.dll","user32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wship6.dll","sxs.dll","schannel.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ED4B4B67839C89883DD0BCD462FDA54E96FB79ED_1_.svg","sha256":"5ba1988c0124d666326559268701fcf00288e460d5922ec88f9e6634cb829ac4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"53B03BEE40C746E8FC70731BA2B6902C0FA65CEA_1_.svg","sha256":"02c9e3df5fa43bb01b9b702f1f6bda697b946da1d516699a92388bfc6e5cad2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"urlref_httpsbit.ly3ikRRIb","sha256":"4528209b26ac18543eac46381a27150e0d145fd8537514b701b44339e9c66671","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"JANWMBN8.txt","sha256":"4d34b3d570fe1a935ab4dbb99a73b53132a2fc4c9a4607afd090e9152906933e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"3ikRRIb_1_.htm","sha256":"4528209b26ac18543eac46381a27150e0d145fd8537514b701b44339e9c66671","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JANWMBN8.txt","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\98FKNM2M\\ED4B4B67839C89883DD0BCD462FDA54E96FB79ED[1].svg","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\53B03BEE40C746E8FC70731BA2B6902C0FA65CEA[1].svg","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6387b52cea66ef2ec417cc7d"}]}]}},"report_ids":{"sandbox_job_ids":["6387b52cea66ef2ec417cc7d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample a131edf272f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a131edf272f1…. Threat score 100/100. 10/27 AV engines flagged this file. 4 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a131edf272f1df1c841a9c457a50011325b1e22e950d62c5e78d3060450e6b93"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample a131edf272f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a131edf272f1…. Threat score 100/100. 10/27 AV engines flagged this file. 4 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a131edf272f1df1c841a9c457a50011325b1e22e950d62c5e78d3060450e6b93"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample a131edf272f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a131edf272f1…. Threat score 100/100. 10/27 AV engines flagged this file. 4 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]