34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 42:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T463,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample a3f665043305… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a3f665043305…. Malware family: Malware. Threat score 100/100. 6/27 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a3f665043305d67f64f7386a8bcd89dc5ce86a76a6b5042827af58cd8b4e10f2","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","a3f665043305d67f64f7386a8bcd89dc5ce86a76a6b5042827af58cd8b4e10f2"],"about":{"@type":"SoftwareApplication","name":"77.exe","applicationCategory":["peexe","executable"],"identifier":"a3f665043305d67f64f7386a8bcd89dc5ce86a76a6b5042827af58cd8b4e10f2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T11f8,Assembly shows XOR instruction xor eax ebp in Stream UID: 47540-1052-00411832 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47540-1052-00411832 Assembly shows XOR instruction xor eax ebp in Stream UID: 47540-1051-004117BE Assembly shows XOR instruction xor ecx ebp in Stream UID: 47540-1051-004117BE Assembly shows XOR instruction xor eax ebp in Stream UID: 47540-1032-0040B6E5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47540-1032-0040B6E5 Assembly shows XOR instruction xor eax ebp in Stream UID: 47540-1025-0040AA1C Assembly shows XOR instruction xor ecx ebp in Stream UID: 47540-1025-0040AA1C Assembly shows XOR instruction xor eax ebp in Stream UID: 47540-1030-00415F2F Assembly shows XOR instruction xor ecx ebp in Stream UID: 47540-1030-00415F2F Assembly shows XOR instruction xor eax ebp in Stream UID: 47540-1049-00411726 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47540-1049-00411726 Assembly shows XOR instruction xor eax ebp in Stream UID: 47540-1026-00413A04 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47540-1026-00413A04 Assembly shows XOR instruction xor eax ebp in Stream UID: 47540-1034-0040B998 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47540-1034-0040B998 Assembly shows XOR instruction xor eax ebp in Stream UID: 47540-1054-00411A04 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47540-1054-00411A04 Assembly shows XOR instruction xor eax ebp in Stream UID: 47540-217-0041619E Assembly shows XOR instruction xor ecx ebp in Stream UID: 47540-217-0041619E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002148-53755-186-0040A48A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002148-53755-186-0040A48A Assembly shows XOR instruction xor dword ptr [esp+10h] eax in Stream UID: 00000000-00002148-53755-63-00404F00 Assembly shows XOR instruction xor dword ptr [esp+20h] eax in Stream UID: 00000000-00002148-53755-63-00404F00 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00002148-53755-63-00404F00 Assembly shows XOR instruction xor cl byte ptr [ebp-02h] in Stream UID: 00000000-00002148-53755-263-00414BA8 Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 00000000-00002148-53755-263-00414BA8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002148-53755-155-00409111 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002148-53755-155-00409111 Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00002148-53755-317-0041036C Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00002148-53755-317-0041036C Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00002148-53755-317-0041036C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002148-53755-326-00415F2F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002148-53755-326-00415F2F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002148-53755-162-00413716 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002148-53755-162-00413716 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002148-53755-361-00411724 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002148-53755-361-00411724 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002148-53755-217-00418062 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002148-53755-217-00418062 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 00000000-00002148-53755-65-00404EA0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002148-53755-158-004133D7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002148-53755-158-004133D7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002148-53755-124-0040747F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002148-53755-216-0041619E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002148-53755-216-0041619E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002148-53755-159-0041375F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002148-53755-159-0041375F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002148-53755-16-00407A23 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002148-53755-16-00407A2337:T1170,".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000008477c8d38e7780297c029c017c0200007c02e2142e735505000012000800b2118c00f5f684772cd38e77d0132e7310b47e022c142e73dcd38e77b8d8120080297c020000947700002e7310000000e0000000e00094770000000024d81200906b7c02f0d8120095e1807780297c02fc010000000000001cd38e77000094770000000058152e73e000947714d81200e8000000f0d8120095e1807754031800fefffffff5f68477634d857780297c0266152e732c142e00b2f4847758d38e773cd9120000002e7300002e73804d8577bcd28e77e8000000e8002e730000000008da1200 (UID: 00000000-00002148) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000d2621b15 (UID: 00000000-00002148) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000012000100000094df1200b2f48477b4d48e770000000010b57e0200007e7018001a00d0000000e0000000e0007e7011000000800f690200006902a011690295e180772c131800feffffff0000000033000000fcdf12001100000000006902800f6902fcdf1200145c8477435c847740d48e77020000000c0269020000690250016902000200000000000050016902a0e11200a401867758df12003300000000f884775001690214137e705825690200000000440000003ff00000110000000000000000000000681d7c0294df12000000000044000044c40069025201005376654372 (UID: 00000000-00002148) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002148) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002148) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000007f02908c7f028b8c7f02000000000000000000007c0200000001f4cc12000000000058da120095e1807794191800feffffff435c847750598477aa000000b80000008a8c7f02888c7f027cce1200b4d21200000000000000000000000000000000000000000000000000400a000000007c021c5c837760d87275ffffffff170000002cce120024000000030000001cd3120048d81200b4d212008600000058ce120096ed8477b28c7f02a06a5a75860000007cce1200b4d212000000000086008800a06a5a757cce1200916c5a75b28c7f02a06a5a75a06a5a75ecd2120002020000 (UID: 00000000-00002148) ".exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002148)38:T59d,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002148) ".exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00002148)39:T3350,".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00002148) ".exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00002148)3a:T26db,Found reference to API (Indicator: "EncodePointer"; File: "77.bin") Found reference to API (Indicator: "DecodePointer"; File: "77.bin") Found reference to API (Indicator: "FlsFree"; File: "77.bin") Found reference to API (Indicator: "FlsSetValue"; File: "77.bin") Found reference to API (Indicator: "FlsGetValue"; File: "77.bin") Found reference to API (Indicator: "FlsAlloc"; File: "77.bin") Found reference to API (Indicator: "GetProcessWindowStation"; File: "77.bin") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "77.bin") Found reference to API (Indicator: "GetLastActivePopup"; File: "77.bin") Found reference to API (Indicator: "GetActiveWindow"; File: "77.bin") Found reference to API (Indicator: "MessageBoxA"; File: "77.bin") Found reference to API (Indicator: "GetComputerNameA"; File: "77.bin") Found reference to API (Indicator: "GetDateFormatW"; File: "77.bin") Found reference to API (Indicator: "FillConsoleOutputCharacterA"; File: "77.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "77.bin") Found reference to API (Indicator: "WritePrivateProfileStructA"; File: "77.bin") Found reference to API (Indicator: "PeekNamedPipe"; File: "77.bin") Found reference to API (Indicator: "TlsGetValue"; File: "77.bin") Found reference to API (Indicator: "GetLocaleInfoA"; File: "77.bin") Found reference to API (Indicator: "GetStringTypeA"; File: "77.bin") Found reference to API (Indicator: "GetProfileIntW"; File: "77.bin") Found reference to API (Indicator: "FindResourceW"; File: "77.bin") Found reference to API (Indicator: "UpdateResourceA"; File: "77.bin") Found reference to API (Indicator: "InterlockedDecrement"; File: "77.bin") Found reference to API (Indicator: "FindCloseChangeNotification"; File: "77.bin") Found reference to API (Indicator: "SetCommBreak"; File: "77.bin") Found reference to API (Indicator: "ConnectNamedPipe"; File: "77.bin") Found reference to API (Indicator: "GetTickCount"; File: "77.bin") Found reference to API (Indicator: "GetConsoleAliasesA"; File: "77.bin") Found reference to API (Indicator: "CreateActCtxW"; File: "77.bin") Found reference to API (Indicator: "WriteConsoleOutputA"; File: "77.bin") Found reference to API (Indicator: "GetNamedPipeInfo"; File: "77.bin") Found reference to API (Indicator: "GetCompressedFileSizeA"; File: "77.bin") Found reference to API (Indicator: "DisconnectNamedPipe"; File: "77.bin") Found reference to API (Indicator: "GetConsoleAliasesW"; File: "77.bin") Found reference to API (Indicator: "GetLastError"; File: "77.bin") Found reference to API (Indicator: "GetProcAddress"; File: "77.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "77.bin") Found reference to API (Indicator: "CreateMemoryResourceNotification"; File: "77.bin") Found reference to API (Indicator: "SearchPathA"; File: "77.bin") Found reference to API (Indicator: "SetFileApisToOEM"; File: "77.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "77.bin") Found reference to API (Indicator: "OpenMutexA"; File: "77.bin") Found reference to API (Indicator: "GetProcessId"; File: "77.bin") Found reference to API (Indicator: "EnumResourceTypesW"; File: "77.bin") Found reference to API (Indicator: "GetOEMCP"; File: "77.bin") Found reference to API (Indicator: "HeapSetInformation"; File: "77.bin") Found reference to API (Indicator: "CancelTimerQueueTimer"; File: "77.bin") Found reference to API (Indicator: "Module32Next"; File: "77.bin") Found reference to API (Indicator: "ReadConsoleInputW"; File: "77.bin") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "77.bin") Found reference to API (Indicator: "ResetWriteWatch"; File: "77.bin") Found reference to API (Indicator: "CharLowerBuffA"; File: "77.bin") Found reference to API (Indicator: "LoadMenuW"; File: "77.bin") Found reference to API (Indicator: "CharUpperBuffA"; File: "77.bin") Found reference to API (Indicator: "CharToOemBuffA"; File: "77.bin") Found reference to API (Indicator: "InterlockedIncrement"; File: "77.bin") Found reference to API (Indicator: "Sleep"; File: "77.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "77.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "77.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "77.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "77.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "77.bin") Found reference to API (Indicator: "HeapFree"; File: "77.bin") Found reference to API (Indicator: "TerminateProcess"; File: "77.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "77.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "77.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "77.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "77.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "77.bin") Found reference to API (Indicator: "RtlUnwind"; File: "77.bin") Found reference to API (Indicator: "RaiseException"; File: "77.bin") Found reference to API (Indicator: "LCMapStringA"; File: "77.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "77.bin") Found reference to API (Indicator: "LCMapStringW"; File: "77.bin") Found reference to API (Indicator: "GetCPInfo"; File: "77.bin") Found reference to API (Indicator: "GetACP"; File: "77.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "77.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "77.bin") Found reference to API (Indicator: "TlsAlloc"; File: "77.bin") Found reference to API (Indicator: "TlsSetValue"; File: "77.bin") Found reference to API (Indicator: "TlsFree"; File: "77.bin") Found reference to API (Indicator: "SetLastError"; File: "77.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "77.bin") Found reference to API (Indicator: "HeapAlloc"; File: "77.bin") Found reference to API (Indicator: "HeapCreate"; File: "77.bin") Found reference to API (Indicator: "VirtualFree"; File: "77.bin") Found reference to API (Indicator: "ExitProcess"; File: "77.bin") Found reference to API (Indicator: "WriteFile"; File: "77.bin") Found reference to API (Indicator: "GetStdHandle"; File: "77.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "77.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "77.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "77.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "77.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "77.bin") Found reference to API (Indicator: "SetHandleCount"; File: "77.bin") Found reference to API (Indicator: "GetFileType"; File: "77.bin") Found reference to API (Indicator: "GetStartupInfoA"; File: "77.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "77.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "77.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "77.bin") Found reference to API (Indicator: "HeapSize"; File: "77.bin") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "77.bin") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "77.bin") Found reference to API (Indicator: "IsValidLocale"; File: "77.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "77.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "77.bin") Found reference to API (Indicator: "CloseHandle"; File: "77.bin") Found reference to API (Indicator: "CreateFileA"; File: "77.bin") Found reference to API (Indicator: "GetLocaleInfoW"; File: "77.bin") Found reference to API (Indicator: "GetConsoleCP"; File: "77.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "77.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "77.bin") Found reference to API (Indicator: "SetFilePointer"; File: "77.bin") Found reference to API (Indicator: "SetStdHandle"; File: "77.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "77.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "77.bin") Found reference to API (Indicator: "ReadFile"; File: "77.bin") Found reference to API (Indicator: "WriteConsoleA"; File: "77.bin") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "77.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "77.bin") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002148.00000000.69802.00401000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002148.00000000.69802.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002148.00000000.69802.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002148.00000000.69802.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002148.00000000.69802.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002148.00000000.69802.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00002148.00000000.69802.00401000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00002148.00000000.69802.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002148.00000000.69802.00401000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002148.00000000.69802.00401000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002148.00000000.69802.00401000.00000020.mdmp")3b:T4d6,".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70e90000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 ".exe" loaded module "KERNEL32" at base 770a0000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73380000 ".exe" loaded module "MSIMG32.DLL" at base 732e0000 ".exe" loaded module "KERNEL32.DLL" at base 770a0000 ".exe" loaded module "MSVCR100.DLL" at base 65740000 ".exe" loaded module "ADVAPI32.DLL" at base 75cd0000 ".exe" loaded module "NTDLL.DLL" at base 777f0000 ".exe" loaded module "WINMM.DLL" at base 707e0000 ".exe" loaded module "WS2_32.DLL" at base 76400000 ".exe" loaded module "CRYPTBASE.DLL" at base 755f0000 ".exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 770a0000 ".exe" loaded module "POWRPROF.DLL" at base 74540000 ".exe" loaded module "ADVAPI32" at base 75cd0000 ".exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 755a00003c:T7b2,".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "")3d:Tbe5,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "77"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "")3e:T59e,".exe" trying to touch file "C:\Windows\system32\IMM32.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" ".exe" trying to touch file "C:\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" ".exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" ".exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" ".exe" trying to touch file "C:\msimg32.dll" ".exe" trying to touch file "C:\Windows\system32\msimg32.dll" ".exe" trying to touch file "C:\msvcr100.dll" ".exe" trying to touch file "C:\Windows\system32\msvcr100.dll" ".exe" trying to touch file "C:\Windows\system32\winmm.dll" ".exe" trying to touch file "C:\cryptbase.dll" ".exe" trying to touch file "C:\Windows\system32\cryptbase.dll" ".exe" trying to touch file "\Device\KsecDD" ".exe" trying to touch file "C:\Windows\system32\powrprof.dll"3f:Ta0e,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")40:T8c8,".exe" allocated at least 792776.0 KB of consecutive memory with 100 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 101 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 102 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 103 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 104 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 105 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 106 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 107 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 108 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 109 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 110 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 111 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 112 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 113 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 114 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 115 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 116 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 117 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 118 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 119 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 120 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 121 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 122 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 123 calls ".exe" allocated at least 792776.0 KB of consecutive memory with 124 calls41:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3cHd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cHB3d3d3d3d3d3d3d3d3d3B3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cHB3d3d3d3d3d3d3d3d3d3Bwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dwcHd3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3dwAAAAd3AAAAAAAAB3d3d3dwAAAAAAAAAAAAAAAAAHd3AAAHd3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAADwAAAD8AAAA8AAAAMAAAAAAAAAAwAAAAMAAAADAAAAAwAAAAMAAAABAAAAAAAAAAMAAAADAAAAAAAAAAKAAAACAAAAAAAAAAKAAAACgAAAAAAAAAMAAAAAAAAAAoAAAAEAAAADAAAAAOAAAAOAAAAH8f/wA////4fAAAAP/////w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"a3f665043305d67f64f7386a8bcd89dc5ce86a76a6b5042827af58cd8b4e10f2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793935387080,"unified_at":"2026-11-06T03:23:07.080Z","metadata":{"hashes":{"sha256":"a3f665043305d67f64f7386a8bcd89dc5ce86a76a6b5042827af58cd8b4e10f2","sha1":"a05f3fa8d1b9c7bc183948a516025503a9dda569","md5":"43a466ea26d18d125bf8af925bb617b7","sha512":"d8c86539b9a115794884f3c6d6fe00beb2e75b0510b85777fc342c691986011864c04c21e0724af5874baa695168fa1e43281e782aeb06348bd572be7b4cf551","ssdeep":"49152:vdndufbt9ODXz12CkNram8AciuXRyjy0EjIdfCN:vdnd6av1iam8Ac4GbU6N","ssdeep_chunks":["49152:vdndufb","49152:dndufbt","49152:ndufbt9","49152:dufbt9O","49152:ufbt9OD","49152:fbt9ODX","49152:bt9ODXz","49152:t9ODXz1","49152:9ODXz12","49152:ODXz12C","49152:DXz12Ck","49152:Xz12CkN","49152:z12CkNr","49152:12CkNra","49152:2CkNram","49152:CkNram8","49152:kNram8A","49152:Nram8Ac","49152:ram8Aci","49152:am8Aciu","49152:m8AciuX","49152:8AciuXR","49152:AciuXRy","49152:ciuXRyj","49152:iuXRyjy","49152:uXRyjy0","49152:XRyjy0E","49152:Ryjy0Ej","49152:yjy0EjI","49152:jy0EjId","49152:y0EjIdf","49152:0EjIdfC","49152:EjIdfCN","98304:vdndufb","98304:dndufbt","98304:ndufbt9","98304:dufbt9O","98304:ufbt9OD","98304:fbt9ODX","98304:bt9ODXz","98304:t9ODXz1","98304:9ODXz12","98304:ODXz12C","98304:DXz12Ck","98304:Xz12CkN","98304:z12CkNr","98304:12CkNra","98304:2CkNram","98304:CkNram8","98304:kNram8A","98304:Nram8Ac","98304:ram8Aci","98304:am8Aciu","98304:m8AciuX","98304:8AciuXR","98304:AciuXRy","98304:ciuXRyj","98304:iuXRyjy","98304:uXRyjy0","98304:XRyjy0E","98304:Ryjy0Ej","98304:yjy0EjI","98304:jy0EjId","98304:y0EjIdf","98304:0EjIdfC","98304:EjIdfCN","49152:vdnd6av","49152:dnd6av1","49152:nd6av1i","49152:d6av1ia","49152:6av1iam","49152:av1iam8","49152:v1iam8A","49152:1iam8Ac","49152:iam8Ac4","49152:am8Ac4G","49152:m8Ac4Gb","49152:8Ac4GbU","49152:Ac4GbU6","49152:c4GbU6N"],"imphash":"724ad9571755841c2e0f4aa3cd09706a"},"file_info":{"file_name":"77.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1945088,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1691072967000,"last_seen":1691075181000,"last_multi_scan":1691075181000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":44},"sandbox_signatures":{"informative_count":94,"suspicious_count":20,"malicious_count":5,"total":119},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packer.pkr_ce1a-9980177-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0056f95c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-VK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Malware-Cryptor.Grygoryi.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Drive-by Compromise","attack_id":"T1189","attack_id_wiki":"https://attack.mitre.org/techniques/T1189","identifiers":[{"type":"suspicious","value":"Possible heap spraying attempt detected"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Contains ability to check if a debugger is running"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains reference to licensed c/c++ library"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"77.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002148.00000000.69802.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002148.00000001.71051.036E0000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002412.00000000.71363.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002412.00000001.73286.03670000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002412.00000002.75209.03670000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003620.00000000.72821.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003620.00000001.74744.03670000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003620.00000002.76666.03670000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"77.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"77.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"77.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"77.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 47540-12281-0040F6C1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002148-53755-124-0040747F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002148-53755-16-00407A23\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002148-53755-17-00408714","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$36","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.8988626611037045","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - Cryptography Rijndael","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"2148\" - (UID: 00000000-00002148)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002148)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\".exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002148)\n \".exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031001578db1200186d727578db12002a6d727500000a770000000000000a77000000000c000d0044eb1200c4db1200dac5547300000a771c5c837743797275ffffffff0c0000004c6283771f797275ffffffff0c000000b0db1200040000000004000001000000c4db1200210ebf0300000000 (UID: 00000000-00002148)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002148-53755-317-0041036C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002148-53755-317-0041036C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002148-53755-317-0041036C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"77.bin\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"77.bin\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"77.bin\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.dll at 47540-1051-004117BE\n GetLocaleInfoA@KERNEL32.dll at 47540-1030-00415F2F\n GetLocaleInfoA@KERNEL32.dll at 47540-1049-00411726\n GetLocaleInfoW@KERNEL32.dll at 47540-1028-00415EFB\n GetLocaleInfoA@KERNEL32.dll at 47540-1054-00411A04\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00002148-53755-324-00415EFB\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00002148-53755-178-00411B2A\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002148-53755-63-00404F00\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002148-53755-326-00415F2F\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002148-53755-162-00413716\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002148-53755-361-00411724\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00002148-53755-180-00411AC3\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002148-53755-189-0041160D\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00002148-53755-177-00411B66","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"77.bin\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002148.00000000.69802.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"77.bin\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002148.00000000.69802.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"77.bin\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00002148-53755-265-0041742B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\NTSystem (UID: 00000000-00002148)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessW\" with parameter \"%APPDATA%\\NTSystem\\ntlhost.exe\" - (UID: 00000000-00002148)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$39","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\wikokaxigus\\mifebabidura\\japirazera80\\ra.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00002148-53755-36-0040B1BA\n Sleep@KERNEL32.DLL at 00000000-00002148-53755-52-0040B175\n Sleep@KERNEL32.DLL at 00000000-00002148-53755-10-0040F6CF\n Sleep@KERNEL32.DLL at 00000000-00002148-53755-104-0040B206","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 77.bin)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: ntlhost.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002148-53755-13-004158C2\n LoadLibraryA@KERNEL32.DLL at 00000000-00002148-53755-60-004051F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"77.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-462","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\".exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \".exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77990000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f46c77@RPCRT4.dll\"\n \"150016003cba5773@ADVAPI32.dll\"\n \"0e000f00b4ba5773@ADVAPI32.dll\"\n \"0e000f00e8ba5773@ADVAPI32.dll\"\n \"1100120048bf5773@ADVAPI32.dll\"\n \"11001200b4bf5773@ADVAPI32.dll\"\n \"12001300c8bf5773@ADVAPI32.dll\"\n \"12001300f0bf5773@ADVAPI32.dll\"\n \"14001500d4d45773@ADVAPI32.dll\"\n \"14001500ecd45773@ADVAPI32.dll\"\n \"1400150004d55773@ADVAPI32.dll\"\n \"170018001cd55773@ADVAPI32.dll\"\n \"0d000e0034d55773@ADVAPI32.dll\"\n \"0f00100060d65773@ADVAPI32.dll\"\n \"14001500a0d65773@ADVAPI32.dll\"\n \"14001500b8d65773@ADVAPI32.dll\"\n \"0c000d0000d75773@ADVAPI32.dll\"\n \"0c000d0010d75773@ADVAPI32.dll\"\n \"0e000f0020d75773@ADVAPI32.dll\"\n \"1800190088d85773@RPCRT4.dll\"\n \"13001400b4d85773@RPCRT4.dll\"\n \"14001500c8d85773@RPCRT4.dll\"\n \"16001700e0d85773@RPCRT4.dll\"\n \"0b000c0068d15773@WS2_32.dll\"\n \"1b001c0060f03a73@api-ms-win-core-synch-l1-2-0.DLL\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"77.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"77.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"77.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"ntlhost.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"ntlhost.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"ntlhost.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"77.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"ntlhost.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"77.bin\" has an executable section named \".text\"\n \"ntlhost.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"77.bin\" has an writable section named \".data\"\n \"ntlhost.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"77.bin\" file has an entrypoint instructions - \"call\t0x41036c,jmp\t0x407eae,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tecx, dword ptr [esp + 4],test\tecx, 3,je\t0x408070,mov\tal, byte ptr [ecx],add\tecx, 1,test\tal, al,je\t0x4080a3,test\tecx, 3,jne\t0x40804c,add\teax, 0,lea\tesp, [esp],lea\tesp, [esp],mov\teax, dword ptr [ecx],mov\tedx, 0x7efefeff,add\tedx, eax,xor\teax, 0xffffffff,xor\teax, edx,add\tecx, 4,test\teax, 0x81010100,je\t0x408070,mov\teax, dword ptr [ecx - 4],test\tal, al,je\t0x4080c1,\"\n \"ntlhost.exe\" file has an entrypoint instructions - \"call\t0x41036c,jmp\t0x407eae,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tecx, dword ptr [esp + 4],test\tecx, 3,je\t0x408070,mov\tal, byte ptr [ecx],add\tecx, 1,test\tal, al,je\t0x4080a3,test\tecx, 3,jne\t0x40804c,add\teax, 0,lea\tesp, [esp],lea\tesp, [esp],mov\teax, dword ptr [ecx],mov\tedx, 0x7efefeff,add\tedx, eax,xor\teax, 0xffffffff,xor\teax, edx,add\tecx, 4,test\teax, 0x81010100,je\t0x408070,mov\teax, dword ptr [ecx - 4],test\tal, al,je\t0x4080c1,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x1c2600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1c24e0\" greater than 0x100000\n Virtual size of \".data\" is \"0x1fee3a4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"77.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ntlhost.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"ntlhost.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: 00000000-00002148]\n \"ntlhost.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%APPDATA%\\NTSystem\\ntlhost.exe]- [targetUID: 00000000-00002148]\n \"wmiprov.log\" has type \"ASCII text with CRLF line terminators\"- [targetUID: 00000000-00002148]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\".exe\" reads file \"c:\\77.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\".exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\msimg32.dll\"\n \".exe\" trying to access non-existent file \"C:\\msvcr100.dll\"\n \".exe\" trying to access non-existent file \"C:\\cryptbase.dll\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\MSIMG32.DLL\"\n \".exe\" trying to access non-existent file \"C:\\MSVCR100.DLL\"\n \".exe\" trying to access non-existent file \"C:\\CRYPTBASE.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\".exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\ntsystem\\ntlhost.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002148-00000C25-37864198\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"77.bin\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"77.bin\")\n Found reference to API \"GetNamedPipeInfo\" (Indicator: \"GetNamedPipe\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"pB.pL\"\n Heuristic match: \"n>P?.PY\"\n Heuristic match: \"kj.gT\"\n Heuristic match: \"u3.sd\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"00000000-00002412.00000002.75209.03670000.00000040.mdmp\"\n YARA signature for AES encryption matched on file \"00000000-00003620.00000001.74744.03670000.00000040.mdmp\"\n YARA signature for AES encryption matched on file \"00000000-00002412.00000001.73286.03670000.00000040.mdmp\"\n YARA signature for AES encryption matched on file \"00000000-00003620.00000002.76666.03670000.00000040.mdmp\"\n YARA signature for AES encryption matched on process \"00000000-00002148\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"ntlhost.exe\"\n YARA signature for RC4 encryption matched on file \"ntlhost.exe.bin\"\n YARA signature for RC4 encryption matched on file \"00000000-00002412.00000000.71363.00401000.00000020.mdmp\"\n YARA signature for RC4 encryption matched on process \"00000000-00002148\"\n YARA signature for RC4 encryption matched on file \"00000000-00003620.00000000.72821.00401000.00000020.mdmp\"\n YARA signature for RC4 encryption matched on file \"00000000-00003620.00000002.76666.03912000.00000004.mdmp\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on file \"00000000-00003620.00000001.74744.03990000.00000004.mdmp\"\n YARA signature for RC4 encryption matched on file \"00000000-00003620.00000002.76666.03990000.00000004.mdmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\".exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\NTSystem\\*.* (UID: 00000000-00002148)\n \".exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00002148)\n \".exe\" called \"FindNextFileW\" with parameter ntlhost.exe (UID: 00000000-00002148)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"Module32Next\" (Indicator: \"Module32Next\"; File: \"77.bin\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"77.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"77.bin\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"77.bin\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"77.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"77.bin\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"77.bin\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00002148.00000000.69802.00401000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002148.00000000.69802.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"(Fri Aug 04 00:12:59 2023.1119026) : C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName](Fri Aug 04 00:12:59 2023.1119026) :\" (Indicator: \"\\drivers\\\"; File: \"wmiprov.log\")\n Found string \"(Fri Aug 04 00:12:59 2023.1119026) : C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName](Fri Aug 04 00:12:59 2023.1119026) :\" (Indicator: \"system32\\drivers\"; File: \"wmiprov.log\")\n Found string \"(Fri Aug 04 00:12:59 2023.1119041) : C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName](Fri Aug 04 00:12:59 2023.1119041) :\" (Indicator: \"\\drivers\\\"; File: \"wmiprov.log\")\n Found string \"(Fri Aug 04 00:12:59 2023.1119041) : C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName](Fri Aug 04 00:12:59 2023.1119041) :\" (Indicator: \"system32\\drivers\"; File: \"wmiprov.log\")\n Found string \"\\Device\\HarddiskVolume2\\77.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002148.00000000.69802.0012D000.00000004.mdmp, 00000000-00002148.00000001.71051.0011F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"77.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"77.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"77.bin\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002148.00000000.69802.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; File: \"77.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ntlhost.exe\" - Location: [%APPDATA%\\NTSystem\\ntlhost.exe]- [targetUID: 00000000-00002148]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"77.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"ntlhost.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.DLL at 00000000-00002148-53755-16-00407A23\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00002148-53755-17-00408714","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Tries to save executable or command in registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"NTSYSTEM\"; Value: \"%APPDATA%\\NTSystem\\ntlhost.exe\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .text with unusual entropies 7.98745904168\n 7.98745904168","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%APPDATA%\\NTSystem\\ntlhost.exe\" has high entropy 7.977328978130471","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 55736-1056-00413D4E\n cpuid at 55736-10917-0058F51B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00002148-53755-304-0040C143\n GetModuleHandleW@KERNEL32.DLL at 00000000-00002148-53755-9-0040BDAE\n GetModuleHandleW@KERNEL32.DLL at 00000000-00002148-53755-56-0040F728\n GetModuleHandleW@KERNEL32.DLL at 00000000-00002148-53755-10-0040F6CF\n GetModuleHandleW@KERNEL32.DLL at 00000000-00002148-53755-14-0040BD33\n GetModuleHandleW@KERNEL32.DLL at 00000000-00002148-53755-32-0040BE9A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 47540-1-0040802B\n GetStartupInfoW@KERNEL32.DLL at 00000000-00002148-53755-1-0040802B\n GetStartupInfoA@KERNEL32.DLL at 00000000-00002148-53755-302-004100CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"$40","origin":"API Call","mitre_attack_id":"T1189","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"32/67 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00002148-53755-59-00405540\n FindResourceW@KERNEL32.DLL at 00000000-00002148-53755-60-004051F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"ntlhost.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: 00000000-00002148]\n \"ntlhost.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%APPDATA%\\NTSystem\\ntlhost.exe]- [targetUID: 00000000-00002148]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"NTSYSTEM\"; Value: \"%APPDATA%\\NTSystem\\ntlhost.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\".exe\" wrote 4096 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\NTSystem\\ntlhost.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"86.6.98.68\"\n \"39.55.63.79\"\n \"6.6.98.68\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"Module32Next@KERNEL32.DLL at 00000000-00002148-53755-62-00405100","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.DLL at 00000000-00002148-53755-1-0040802B\n GetCommandLineW@KERNEL32.DLL at 00000000-00002148-53755-400-004100C6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.DLL at 00000000-00002148-53755-299-0040FFC1\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00002148-53755-11-0040FA07","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ntlhost.exe\" claimed CRC 1994067 while the actual is CRC 5092731","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"WriteFile\n ConnectNamedPipe\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n DisconnectNamedPipe\n TerminateProcess\n GetTickCount\n LoadLibraryA\n GetStartupInfoA\n GetStartupInfoW\n GetComputerNameA\n GetProcAddress\n CreateFileA\n GetCommandLineW\n GetModuleHandleW\n FindResourceW\n Sleep\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"d5d90e7730c60e77e0c20e7742c60e7710c60e77acdc0e77a0df0e7736da0e7787f10e770000000091779477c09094777f6f94771ffa9477def49477f2829477857d947700000000\" to virtual address \"0x732E1000\" (part of module \"MSIMG32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"32/67 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\NTSystem\\ntlhost.exe\" (Handle: 264)\n \".exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\NTSystem\\ntlhost.exe\" (Handle: 264)\n \".exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\NTSystem\\ntlhost.exe\" (Handle: 264)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]}],"incidents":[{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Found a Wine emulator related string"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":32,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"64cc41ebadb8e94f1400a97d","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"77.exe","analysis_start_time":"2023-08-04T00:10:20+00:00","indicators_count":{"informative":94,"suspicious":27,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}],"processes":[{"pid":2148,"ppid":0,"name":"77.exe","command_line":"","sha256":"a3f665043305d67f64f7386a8bcd89dc5ce86a76a6b5042827af58cd8b4e10f2","normalized_path":"C:\\77.exe","uid":"00000000-00002148","icon":"$41"}],"all_imported_dlls":["advapi32.dll","usp10.dll","sechost.dll","msvcr100.dll","KernelBase.dll","user32.dll","msctf.dll","VxSSL32.dll","ws2_32.dll","nsi.dll","WSHTCPIP.DLL","wship6.dll","kernel32.dll","imm32.dll","powrprof.dll","apphelp.dll","lpk.dll","msvcrt.dll","ole32.dll","oleaut32.dll","wshqos.dll","gdi32.dll","winmm.dll","cryptbase.dll","setupapi.dll","ntdll.dll","rpcrt4.dll","fltLib.dll","msimg32.dll","cfgmgr32.dll","devobj.dll","api-ms-win-core-synch-l1-2-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ntlhost.exe","sha256":"cf5e868684169d0539f9897f9aec1f23136459c60f56b23f891579c9a9b33494","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]},{"name":"wmiprov.log","sha256":"56a5f44006774a2f9f20aa2f3a9ba99921ddcc1d20c022092224127d7ea24d9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64cc41ebadb8e94f1400a97d"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["64cc41ebadb8e94f1400a97d"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Malware Sample a3f665043305… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a3f665043305…. Malware family: Malware. Threat score 100/100. 6/27 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a3f665043305d67f64f7386a8bcd89dc5ce86a76a6b5042827af58cd8b4e10f2"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample a3f665043305… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a3f665043305…. Malware family: Malware. Threat score 100/100. 6/27 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a3f665043305d67f64f7386a8bcd89dc5ce86a76a6b5042827af58cd8b4e10f2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample a3f665043305… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a3f665043305…. Malware family: Malware. Threat score 100/100. 6/27 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]] 32:null