26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample a8b1d5171c2a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a8b1d5171c2a…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 17 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6"],"about":{"@type":"SoftwareApplication","name":"bounty-76939520352728895","applicationCategory":["peexe","assembly","executable"],"identifier":"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":17,"suspicious":31},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T43a,".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "REMCOS 2023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "REMCOS 2023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "warzone file 3.12.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "warzone file 3.12.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "windows.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")28:T559,PathFileExistsW@SHLWAPI.DLL at 00000000-00003696-58374-561-012CCD85 PathFileExistsW@SHLWAPI.DLL at 00000000-00003696-58374-564-012CD80A PathFileExistsW@SHLWAPI.DLL at 00000000-00003696-58374-558-012CC5FA PathFileExistsW@SHLWAPI.DLL at 00000000-00003696-58374-606-012D1FF8 PathFileExistsW@SHLWAPI.DLL at 00000000-00003696-58374-584-012CEB2D PathFileExistsW@SHLWAPI.DLL at 00000000-00003696-58374-337-012C1E4C PathFileExistsW@SHLWAPI.DLL at 00000000-00003696-58374-563-012CD25C PathFileExistsW@SHLWAPI.DLL at 00000000-00003696-58374-573-012CF332 PathFileExistsW@SHLWAPI.DLL at 00000000-00003696-58374-574-012CE279 PathFileExistsW@SHLWAPI.DLL at 00000000-00003696-58374-541-012CBF77 PathFileExistsW@SHLWAPI.DLL at 00000000-00003696-58374-583-012CFA23 PathFileExistsW@SHLWAPI.DLL at 00000000-00003400-8368-563-0086D25C PathFileExistsW@SHLWAPI.DLL at 00000000-00003400-8368-583-0086FA23 PathFileExistsW@SHLWAPI.DLL at 00000000-00003400-8368-574-0086E279 PathFileExistsW@SHLWAPI.DLL at 00000000-00003400-8368-337-00861E4C PathFileExistsW@SHLWAPI.DLL at 00000000-00003400-8368-561-0086CD85 PathFileExistsW@SHLWAPI.DLL at 00000000-00003400-8368-541-0086BF77 PathFileExistsW@SHLWAPI.DLL at 00000000-00003400-8368-606-00871FF8 PathFileExistsW@SHLWAPI.DLL at 00000000-00003400-8368-564-0086D80A PathFileExistsW@SHLWAPI.DLL at 00000000-00003400-8368-558-0086C5FA29:T560,GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-450-012C4FE8 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-397-012C4083 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-434-012C4BD6 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-656-012D8F3A GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-658-012D9019 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-415-012C44A9 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-425-012C48C0 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-661-012D94BB GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-394-012C4009 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-408-012C42FB GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-390-012C3E97 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-410-012C4365 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-17-012C698F GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-42-012C6944 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-221-012C15F1 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-651-012D8DF5 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-447-012C4F32 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-443-012C4E8F GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-378-012C3B12 GetProcessHeap@KERNEL32.DLL at 00000000-00003696-58374-106-012C68052a:T518,".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\REMCOS 2023.EXE") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\REMCOS 2023.EXE") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WARZONE FILE 3.12.EXE") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WARZONE FILE 3.12.EXE") "REMCOS 2023.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\EXPLORER.EXE") "REMCOS 2023.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\EXPLORER.EXE") "warzone file 3.12.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WARZONE FILE 3.12.EXE") "warzone file 3.12.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WARZONE FILE 3.12.EXE")2b:T5fd,".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\Caches (UID: 00000000-00002620) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Roaming\Vmavovpfgj (UID: 00000000-00002620) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\Caches (UID: 00000000-00003804) "powershell.exe" called "CreateDirectoryW" (UID: 00000000-00003804) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00003804) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Roaming (UID: 00000000-00003804) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\Caches (UID: 00000000-00002056) "REMCOS 2023.exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\Caches (UID: 00000000-00001796) "warzone file 3.12.exe" called "CreateDirectoryW" with parameter C:\Program Files\Microsoft DN1 (UID: 00000000-00003696) "warzone file 3.12.exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\Documents (UID: 00000000-00003696) "warzone file 3.12.exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local\Microsoft Vision\ (UID: 00000000-00003696) "Explorer.exe" called "CreateDirectoryW" with parameter C:\ProgramData\1234567ME (UID: 00000000-00001956)2c:T4b8,".exe" called "CreateProcessW" with parameter ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==" - (UID: 00000000-00002620) ".exe" called "CreateProcessA" with parameter "C:\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe" - (UID: 00000000-00002620) ".exe" called "CreateProcessW" with parameter ""C:\Users\HAPUBWS\AppData\Local\Temp\REMCOS 2023.exe" " - (UID: 00000000-00002056) ".exe" called "CreateProcessW" with parameter ""C:\Users\HAPUBWS\AppData\Local\Temp\warzone file 3.12.exe" " - (UID: 00000000-00002056) "REMCOS 2023.exe" called "CreateProcessW" with parameter ""C:\ProgramData\ATM Machine\Explorer.exe" " - (UID: 00000000-00001796) "warzone file 3.12.exe" called "CreateProcessA" with parameter "powershell Add-MpPreference -ExclusionPath C:\" - (UID: 00000000-00003696) "warzone file 3.12.exe" called "CreateProcessW" with parameter "C:\Users\HAPUBWS\Documents\windows.exe" - (UID: 00000000-00003696) "windows.exe" called "CreateProcessA" with parameter "powershell Add-MpPreference -ExclusionPath C:\" - (UID: 00000000-00003400)2d:T423,Sleep@KERNEL32.DLL at 00000000-00003696-58374-629-012D70E4 Sleep@KERNEL32.DLL at 00000000-00003696-58374-3-012D9136 Sleep@KERNEL32.DLL at 00000000-00003696-58374-11-012C516A Sleep@KERNEL32.DLL at 00000000-00003696-58374-459-012D304C Sleep@KERNEL32.DLL at 00000000-00003696-58374-574-012CE279 Sleep@KERNEL32.DLL at 00000000-00003696-58374-359-012C98CF Sleep@KERNEL32.DLL at 00000000-00003696-58374-57-012D755E Sleep@KERNEL32.DLL at 00000000-00003696-58374-618-012D3896 Sleep@KERNEL32.DLL at 00000000-00003696-58374-89-012C6352 Sleep@KERNEL32.DLL at 00000000-00003400-8368-459-0087304C Sleep@KERNEL32.DLL at 00000000-00003400-8368-574-0086E279 Sleep@KERNEL32.DLL at 00000000-00003400-8368-57-0087755E Sleep@KERNEL32.DLL at 00000000-00003400-8368-3-00879136 Sleep@KERNEL32.DLL at 00000000-00003400-8368-629-008770E4 Sleep@KERNEL32.DLL at 00000000-00003400-8368-618-00873896 Sleep@KERNEL32.DLL at 00000000-00003400-8368-11-0086516A Sleep@KERNEL32.DLL at 00000000-00003400-8368-89-00866352 Sleep@KERNEL32.DLL at 00000000-00003400-8368-359-008698CF2e:T534,LoadLibraryExW@KERNEL32.DLL at 00000000-00001796-55296-10-004371A3 LoadLibraryExW@KERNEL32.DLL at 00000000-00001796-55296-21-00446936 LoadLibraryA@KERNEL32.DLL at 00000000-00003696-58374-880-012C69BA LoadLibraryA@KERNEL32.DLL at 00000000-00003696-58374-81-012D4AF2 LoadLibraryA@KERNEL32.DLL at 00000000-00003696-58374-52-012C57B9 LoadLibraryA@KERNEL32.DLL at 00000000-00003696-58374-91-012C675F LoadLibraryExW@KERNEL32.DLL at 00000000-00003696-58374-610-012D47A7 LoadLibraryA@KERNEL32.DLL at 00000000-00003696-58374-474-012D4B42 LoadLibraryA@KERNEL32.DLL at 00000000-00003696-58374-3-012D9136 LoadLibraryA@KERNEL32.DLL at 00000000-00003696-58374-362-012C22D8 LoadLibraryA@KERNEL32.DLL at 00000000-00003696-58374-589-012CEE6A LoadLibraryA@KERNEL32.DLL at 00000000-00003696-58374-240-012D4927 LoadLibraryW@KERNEL32.DLL at 00000000-00003696-58374-711-012CA6F1 LoadLibraryExW@KERNEL32.DLL at 00000000-00001956-263-21-00446936 LoadLibraryExW@KERNEL32.DLL at 00000000-00001956-263-10-004371A3 LoadLibraryExW@KERNEL32.DLL at 00000000-00003400-8368-610-008747A7 LoadLibraryA@KERNEL32.DLL at 00000000-00003400-8368-362-008622D8 LoadLibraryA@KERNEL32.DLL at 00000000-00003400-8368-474-00874B42 LoadLibraryA@KERNEL32.DLL at 00000000-00003400-8368-589-0086EE6A LoadLibraryA@KERNEL32.DLL at 00000000-00003400-8368-240-008749272f:T51e,"Software\Classes\Folder\shell\open\command" "SYSTEM\CurrentControlSet\Services\TermService\Parameters" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" "Software\Microsoft\Office\15.0Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" "software\Aerofox\FoxmailPreview" "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" "Software\Microsoft\Windows\CurrentVersion\Internet Settings" "SOFTWARE\_rptls" "SYSTEM\CurrentControlSet\Control\Terminal Server" "SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core" "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" "SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns" "SYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip Redirector" "SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VC" "SOFTWARE\Microsoft\Cryptography" "\Opera Software\Opera Stable\Local State"30:Tbd3,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") ".exe" touched "Recycle Bin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") ".exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") ".exe" touched "UsersLibraries" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") ".exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") ".exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") ".exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") ".exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") ".exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") ".exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") ".exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") ".exe" touched "DXP" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") ".exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") ".exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER")31:Tce8,"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.bin" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al," "windows.exe" file has an entrypoint instructions - "pushebp,movebp, esp,subesp, 0x48,pushesi,calldword ptr [0x41a0bc],anddword ptr [ebp - 0x1c], 0,leaeax, [ebp - 0x48],pusheax,calldword ptr [0x41a0c0],call0x406805,movedx, 0x42003c,movecx, 0x420000,call0x4067eb,push0,calldword ptr [0x41a244],pushecx,pushecx,call0x419136,movesi, eax,call0x40684d,pushesi,calldword ptr [0x41a228],int3,pushesi,pushedi,movedi, edx,movesi, ecx,jmp0x4067fe,moveax, dword ptr [esi],testeax, eax,je0x4067fb,calleax,addesi, 4,cmpesi, edi,jb0x4067f3," "REMCOS 2023.exe" file has an entrypoint instructions - "call0x4332eb,jmp0x432ce0,pushebp,movebp, esp,subesp, 0x324,pushebx,pushesi,push0x17,call0x45554a,testeax, eax,je0x432e6d,movecx, dword ptr [ebp + 8],int0x29,xoresi, esi,leaeax, [ebp - 0x324],push0x2cc,pushesi,pusheax,movdword ptr [0x46fd14], esi,call0x435320,addesp, 0xc,movdword ptr [ebp - 0x274], eax,movdword ptr [ebp - 0x278], ecx,movdword ptr [ebp - 0x27c], edx,movdword ptr [ebp - 0x280], ebx,movdword ptr [ebp - 0x284], esi," "Dppvbouy.exe" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,"32:T58a,"windows.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%USERPROFILE%\Documents\windows.exe]- [targetUID: 00000000-00003400] "REMCOS 2023.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\REMCOS 2023.exe]- [targetUID: 00000000-00001796] "Explorer.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\ATM Machine\Explorer.exe]- [targetUID: 00000000-00001796] "Dppvbouy.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%APPDATA%\Vmavovpfgj\Dppvbouy.exe]- [targetUID: 00000000-00002620] "warzone file 3.12.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\warzone file 3.12.exe]- [targetUID: 00000000-00003696] "AY6AY1EUHVJ36ECBQDA5.temp" has type "data"- Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\AY6AY1EUHVJ36ECBQDA5.temp]- [targetUID: 00000000-00003804] "logs.dat" has type "data"- Location: [%ALLUSERSPROFILE%\1234567ME\logs.dat]- [targetUID: 00000000-00001956] "RLBY7XZFY94TL32IWIZK.temp" has type "data"- Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\RLBY7XZFY94TL32IWIZK.temp]- [targetUID: 00000000-00000716] "BYXTCR1RBIRTWUS5RAZU.temp" has type "data"- Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\BYXTCR1RBIRTWUS5RAZU.temp]- [targetUID: 00000000-00003788]33:T761,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch"34:T462,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll"35:T40e,"Software\Microsoft\Office\15.0Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 58374-585-012D04A0 "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 58374-585-012D04A0 "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 58374-585-012D04A0 "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 58374-585-012D04A0 "\Thunderbird\" in Source: 58374-583-012CFA23 "icrosoft\Office\15.0Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp "\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp "ffice\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp36:T52a,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "REMCOS 2023.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "REMCOS 2023.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "warzone file 3.12.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "warzone file 3.12.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Explorer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Explorer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")37:T4f7,".exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "DPPVBOUY"; Value: ""%APPDATA%\Vmavovpfgj\Dppvbouy.exe"") "REMCOS 2023.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "EXPLORER"; Value: ""%ALLUSERSPROFILE%\ATM Machine\Explorer.exe"") "REMCOS 2023.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "REMCOS 2023.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "EXPLORER"; Value: ""%ALLUSERSPROFILE%\ATM Machine\Explorer.exe"") "REMCOS 2023.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "Explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "EXPLORER"; Value: ""%ALLUSERSPROFILE%\ATM Machine\Explorer.exe"") "Explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "Explorer.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "EXPLORER"; Value: ""%ALLUSERSPROFILE%\ATM Machine\Explorer.exe"") "Explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\")38:T5a2,GetModuleFileNameA@KERNEL32.DLL at 00000000-00003696-58374-228-012C177F GetModuleFileNameA@KERNEL32.DLL at 00000000-00003696-58374-478-012C1E45 GetModuleFileNameW@KERNEL32.DLL at 00000000-00003696-58374-28-012D4844 GetModuleFileNameA@KERNEL32.DLL at 00000000-00003696-58374-80-012D8E75 GetModuleFileNameA@KERNEL32.DLL at 00000000-00003696-58374-59-012D747B GetModuleFileNameW@KERNEL32.DLL at 00000000-00003696-58374-4-012D6A31 GetModuleFileNameA@KERNEL32.DLL at 00000000-00003696-58374-18-012D6B8F GetModuleFileNameA@KERNEL32.DLL at 00000000-00003696-58374-3-012D9136 GetModuleFileNameA@KERNEL32.DLL at 00000000-00003696-58374-362-012C22D8 K32GetModuleFileNameExW@KERNEL32.DLL at 00000000-00003696-58374-253-012D5C5D GetModuleFileNameA@KERNEL32.DLL at 00000000-00003400-8368-362-008622D8 GetModuleFileNameW@KERNEL32.DLL at 00000000-00003400-8368-28-00874844 GetModuleFileNameW@KERNEL32.DLL at 00000000-00003400-8368-4-00876A31 GetModuleFileNameA@KERNEL32.DLL at 00000000-00003400-8368-478-00861E45 GetModuleFileNameA@KERNEL32.DLL at 00000000-00003400-8368-3-00879136 GetModuleFileNameA@KERNEL32.DLL at 00000000-00003400-8368-228-0086177F K32GetModuleFileNameExW@KERNEL32.DLL at 00000000-00003400-8368-253-00875C5D GetModuleFileNameA@KERNEL32.DLL at 00000000-00003400-8368-59-0087747B GetModuleFileNameA@KERNEL32.DLL at 00000000-00003400-8368-18-00876B8F GetModuleFileNameA@KERNEL32.DLL at 00000000-00003400-8368-80-00878E7539:T8fd,"\Google\Chrome\User Data\Default\History" (Indicator: "google\chrome\user data") in Source: 58374-561-012CCD85 "\Mozilla\Firefox\" (Indicator: "mozilla\firefox\") in Source: 58374-564-012CD80A "\Google\Chrome\User Data\Local State" (Indicator: "google\chrome\user data") in Source: 58374-540-012CBEEB "\Google\Chrome\User Data\Default\Login Data" (Indicator: "google\chrome\user data") in Source: 58374-540-012CBEEB "Local\Google\Chrome\User Data\Default\Network\Cookies" (Indicator: "google\chrome\user data") in Source: 58374-362-012C22D8 "\Microsoft\Edge\User Data\Default\cookies" (Indicator: "microsoft\edge\user data") in Source: 58374-362-012C22D8 "\Google\Chrome\User Data\Default\Network\Cookies" (Indicator: "google\chrome\user data") in Source: 58374-565-012CDC9D "\Microsoft\Edge\User Data\Local State" (Indicator: "microsoft\edge\user data") in Source: 58374-565-012CDC9D "\Microsoft\Edge\User Data\Default\Network\Cookies" (Indicator: "microsoft\edge\user data") in Source: 58374-565-012CDC9D "\Epic Privacy Browser\User Data\Local State" (Indicator: "epic privacy browser\user data") in Source: 58374-565-012CDC9D "\Epic Privacy Browser\User Data\Default\Login Data" (Indicator: "epic privacy browser\user data") in Source: 58374-565-012CDC9D "\Microsoft\Edge\User Data\Default\Login Data" (Indicator: "microsoft\edge\user data") in Source: 58374-565-012CDC9D "\UCBrowser\User Data_i18n\Local State" (Indicator: "ucbrowser\user data") in Source: 58374-565-012CDC9D "\UCBrowser\User Data_i18n\Default\UC Login Data.17" (Indicator: "ucbrowser\user data") in Source: 58374-565-012CDC9D "\Tencent\QQBrowser\User Data\Local State" (Indicator: "tencent\qqbrowser\user data") in Source: 58374-565-012CDC9D "\Tencent\QQBrowser\User Data\Default\Login Data" (Indicator: "tencent\qqbrowser\user data") in Source: 58374-565-012CDC9D "\Opera Software\Opera Stable\Local State" (Indicator: "opera software\opera stable\local state") in Source: 58374-565-012CDC9D "\Opera Software\Opera Stable\Login Data" (Indicator: "opera software\opera stable\login data") in Source: 58374-565-012CDC9D "\Blisk\User Data\Local State" (Indicator: "blisk\user data") in Source: 58374-565-012CDC9D "\Blisk\User Data\Default\Login Data" (Indicator: "blisk\user data") in Source: 58374-565-012CDC9D3a:T966,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AY6AY1EUHVJ36ECBQDA5.temp" with delete access "powershell.exe" opened "C:\Windows\assembly\NativeImages_v2.0.50727_32\index388.dat" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.3804.907391375" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.3804.907391375" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\SECURITY.CONFIG.CCH.3804.907391390" with delete access "warzone file 3.12.exe" opened "C:\Users\%OSUSER%\Documents\windows.exe:Zone.Identifier" with delete access "warzone file 3.12.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\warzone file 3.12.exe:Zone.Identifier" with delete access "warzone file 3.12.exe" opened "C:\Users\%OSUSER%\Documents\windows.exe:ZONE.IDENTIFIER" with delete access "warzone file 3.12.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\warzone file 3.12.exe:ZONE.IDENTIFIER" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RLBY7XZFY94TL32IWIZK.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF10a4fc.TMP" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.716.907424968" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.716.907424968" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\SECURITY.CONFIG.CCH.716.907424968" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BYXTCR1RBIRTWUS5RAZU.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF10bd85.TMP" with delete access3b:T624,RegCreateKeyExW RegDeleteKeyA RegCloseKey RegDeleteKeyW RegCreateKeyExA SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW RegOpenKeyW RegOpenKeyExA RegEnumKeyExW RegDeleteValueW StartServiceW ChangeServiceConfigW GetDriveTypeW FindNextFileA GetTempPathW CopyFileW WriteProcessMemory GetModuleFileNameW GetModuleFileNameA LoadLibraryExW GetModuleHandleA CreateThread GetSystemDirectoryW TerminateProcess CreateToolhelp32Snapshot Process32First LoadLibraryW GetTickCount VirtualProtect LoadLibraryA Process32Next CreateRemoteThread GetStartupInfoA GetFileSize OpenProcess CreateDirectoryW DeleteFileW GetProcAddress VirtualProtectEx GetComputerNameW WriteFile GetFileSizeEx FindNextFileW FindFirstFileW CreateFileW CreateFileA VirtualAllocEx WinExec Process32NextW LockResource GetCommandLineA Process32FirstW FindFirstFileA GetModuleHandleW CreateProcessA FindResourceW CreateProcessW Sleep VirtualAlloc ShellExecuteW GetClipboardData recv send WSAStartup connect socket closesocket URLDownloadToFileW RegCreateKeyW RegCreateKeyA GetUserNameW RegEnumKeyExA GetDriveTypeA GetFileAttributesW UnhandledExceptionFilter GetThreadContext IsDebuggerPresent GetSystemDirectoryA GetModuleHandleExW ExitThread DeleteFileA GetStartupInfoW ReadProcessMemory GetTempFileNameW FindFirstFileExA GetNativeSystemInfo GetCommandLineW FindResourceA ShellExecuteExA GetWindowThreadProcessId GetCursorPos SetWindowsHookExA InternetReadFile InternetOpenW InternetCloseHandle InternetOpenUrlW3c:T8f5,".exe" wrote bytes "e9abfe68f2" to virtual address "0x7700CCF0" ("URLDownloadToFileA@URLMON.DLL") ".exe" wrote bytes "e96b8748f2" to virtual address "0x772139C0" ("HttpOpenRequestW@WININET.DLL") ".exe" wrote bytes "e94bd047f2" to virtual address "0x7721F7D0" ("InternetReadFile@WININET.DLL") ".exe" wrote bytes "db4d6c7000000000" to virtual address "0x00022000" (part of module "A8B1D5171C2A80EF5DECD6EB87655159A6268984FF9A89304DF515A0248B91E6.EXE") ".exe" wrote bytes "e92bef42f2" to virtual address "0x7726C280" ("InternetOpenA@WININET.DLL") ".exe" wrote bytes "e9ebed42f2" to virtual address "0x7726C810" ("InternetOpenW@WININET.DLL") ".exe" wrote bytes "e9bb1772f2" to virtual address "0x76F7B840" ("URLDownloadToFileW@URLMON.DLL") ".exe" wrote bytes "e99bfe40f2" to virtual address "0x7728BBC0" ("HttpOpenRequestA@WININET.DLL") ".exe" wrote bytes "0a80a005" to virtual address "0x6852F798" (part of module "CLR.DLL") ".exe" wrote bytes "e93b038ef3" to virtual address "0x75DA8790" ("ShellExecuteA@SHELL32.DLL") ".exe" wrote bytes "e9e253b1f3" to virtual address "0x75B73C29" ("ShellExecuteW@SHELL32.DLL") "powershell.exe" wrote bytes "e93b038ef3" to virtual address "0x75DA8790" (part of module "SHELL32.DLL") "powershell.exe" wrote bytes "d055be756473c7750000000051c1c4769498c476ee9cc47675dcc676273ec6760fb3ca7600000000acdcde761bf7de76c108e076c0d9de76152ede7636dade76d5d9de7630c6de76e0c2de7642c6de761bc6de7686c4de7672c6de7600000000" to virtual address "0x693A1000" (part of module "SHFOLDER.DLL") "powershell.exe" wrote bytes "c44d5a0e" to virtual address "0x64301FFC" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "e9e253b1f3" to virtual address "0x75B73C29" (part of module "SHELL32.DLL") ".exe" wrote bytes "db4d6c7000000000" to virtual address "0x00402000" ".exe" wrote bytes "e9b07880f2" to virtual address "0x76E9372B" ("EnumWindows@USER32.DLL") ".exe" wrote bytes "e9ee7480f2" to virtual address "0x76E9332D" ("GetForegroundWindow@USER32.DLL") ".exe" wrote bytes "e99ef480f2" to virtual address "0x76E8B88D" ("GetWindowTextW@USER32.DLL")3d:Tebe,".exe" wrote 32 bytes to a remote process "C:\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe" (Handle: 552) ".exe" wrote 52 bytes to a remote process "C:\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe" (Handle: 552) ".exe" wrote 4 bytes to a remote process "C:\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe" (Handle: 552) ".exe" wrote 880640 bytes to a remote process "C:\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe" (Handle: 548) ".exe" wrote 4 bytes to a remote process "C:\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe" (Handle: 548) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 920) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 920) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 920) ".exe" wrote 32 bytes to a remote process "C:\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe" (Handle: 548) ".exe" wrote 52 bytes to a remote process "C:\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe" (Handle: 548) ".exe" wrote 4096 bytes to a remote process "C:\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe" (Handle: 548) ".exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\REMCOS 2023.exe" (Handle: 968) ".exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\REMCOS 2023.exe" (Handle: 968) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\REMCOS 2023.exe" (Handle: 968) ".exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\warzone file 3.12.exe" (Handle: 976) ".exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\warzone file 3.12.exe" (Handle: 976) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\warzone file 3.12.exe" (Handle: 976) "REMCOS 2023.exe" wrote 32 bytes to a remote process "C:\ProgramData\ATM Machine\Explorer.exe" (Handle: 544) "REMCOS 2023.exe" wrote 52 bytes to a remote process "C:\ProgramData\ATM Machine\Explorer.exe" (Handle: 544) "REMCOS 2023.exe" wrote 4 bytes to a remote process "C:\ProgramData\ATM Machine\Explorer.exe" (Handle: 544) "warzone file 3.12.exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 484) "warzone file 3.12.exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 484) "warzone file 3.12.exe" wrote 4 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 484) "warzone file 3.12.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\Documents\windows.exe" (Handle: 496) "warzone file 3.12.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Documents\windows.exe" (Handle: 496) "warzone file 3.12.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\Documents\windows.exe" (Handle: 496) "windows.exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 476) "windows.exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 476) "windows.exe" wrote 4 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 476)3e:T21ff,YARA signature "Codoso_Gh0st_1" classified file "windows.exe" as "apt,codoso,plugx" based on indicators: "45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a007b00330061006400300035003500370035002d0038003800350037002d0034003800350030002d0039003200370037002d003100310062003800350062006400620038006500300039007d00,45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a00" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, Author: Florian Roth) YARA signature "Codoso_Gh0st_2" classified file "windows.exe" as "apt,codoso,plugx" based on indicators: "45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a007b00330061006400300035003500370035002d0038003800350037002d0034003800350030002d0039003200370037002d003100310062003800350062006400620038006500300039007d00" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, Author: Florian Roth) YARA signature "MALWARE_Win_AveMaria" matched file "windows.exe" as "AveMaria variant payload" based on indicators: "PK11_CheckUserPassword,PK11_Authenticate,PK11SDR_Decrypt,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList,127.0.0.,52004400500043006c0069007000,4700720061006200620065007200,2f006e003a002500740065006d00700025005c0065006c006c006f0063006e0061006b002e0078006d006c00,4800650079002000490027006d002000410064006d0069006e00,73006f00660074006f006b006e0033002e0064006c006c00,6e007300730033002e0064006c006c00,6c006f00670069006e0073002e006a0073006f006e00" (Author: ditekSHen) YARA signature "MALWARE_Win_EXEPWSH_DLAgent" matched file "windows.exe" as "Detects SystemBC" based on indicators: "powershell,User-Agent:,LdrLoadDll" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_Binary_References_Browsers" matched file "windows.exe" as "Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers." based on indicators: "54006f007200630068005c00550073006500720020004400610074006100,4300680072006f006d00690075006d005c00550073006500720020004400610074006100,47006f006f0067006c0065005c004300680072006f006d0065005c00550073006500720020004400610074006100,56006900760061006c00640069005c00550073006500720020004400610074006100,4f007000650072006100200053006f006600740077006100720065005c00,43006f006d006f0064006f005c0044007200610067006f006e005c00550073006500720020004400610074006100,55004300420072006f0077007300650072005c00,4500700069006300200050007200690076006100630079002000420072006f0077007300650072005c00,430065006e007400420072006f0077007300650072005c00550073006500720020004400610074006100,53006c0069006d006a00650074005c00550073006500720020004400610074006100,42006c00690073006b005c00550073006500720020004400610074006100,Edge\User Data,45006400670065005c00550073006500720020004400610074006100,51005100420072006f0077007300650072005c00550073006500720020004400610074006100,420072006100760065002d00420072006f0077007300650072005c00550073006500720020004400610074006100" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore" matched file "windows.exe" as "Detects executables containing SQL queries to confidential data stores. Observed in infostealers" based on indicators: "select ,SELECT ,530045004c004500430054002000, from logins, from cookies, FROM moz_cookies,4e0061006d006500,name,Name,password_value,encrypted_value,isHttpOnly" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM" matched file "windows.exe" as "Detects executables embedding command execution via IExecuteCommand COM object" based on indicators: "Classes\Folder\shell\open\command,DelegateExecute" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM" matched file "REMCOS 2023.exe" as "Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)" based on indicators: "7b00330045003500460043003700460039002d0039004100350031002d0034003300360037002d0039003000360033002d004100310032003000320034003400460042004500430037007d00,CoGetObject,45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a00" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM" matched file "Explorer.exe" as "Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)" based on indicators: "7b00330045003500460043003700460039002d0039004100350031002d0034003300360037002d0039003000360033002d004100310032003000320034003400460042004500430037007d00,CoGetObject,45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a00" (Author: ditekSHen) YARA signature "Codoso_Gh0st_1" classified file "warzone file 3.12.exe" as "apt,codoso,plugx" based on indicators: "45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a007b00330061006400300035003500370035002d0038003800350037002d0034003800350030002d0039003200370037002d003100310062003800350062006400620038006500300039007d00,45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a00" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, Author: Florian Roth) YARA signature "Codoso_Gh0st_2" classified file "warzone file 3.12.exe" as "apt,codoso,plugx" based on indicators: "45006c00650076006100740069006f006e003a00410064006d0069006e006900730074007200610074006f00720021006e00650077003a007b00330061006400300035003500370035002d0038003800350037002d0034003800350030002d0039003200370037002d003100310062003800350062006400620038006500300039007d00" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, Author: Florian Roth) YARA signature "MALWARE_Win_AveMaria" matched file "warzone file 3.12.exe" as "AveMaria variant payload" based on indicators: "PK11_CheckUserPassword,PK11_Authenticate,PK11SDR_Decrypt,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList,127.0.0.,52004400500043006c0069007000,4700720061006200620065007200,2f006e003a002500740065006d00700025005c0065006c006c006f0063006e0061006b002e0078006d006c00,4800650079002000490027006d002000410064006d0069006e00,73006f00660074006f006b006e0033002e0064006c006c00,6e007300730033002e0064006c006c00,6c006f00670069006e0073002e006a0073006f006e00" (Author: ditekSHen) YARA signature "MALWARE_Win_EXEPWSH_DLAgent" matched file "warzone file 3.12.exe" as "Detects SystemBC" based on indicators: "powershell,User-Agent:,LdrLoadDll" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_Binary_References_Browsers" matched file "warzone file 3.12.exe" as "Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers." based on indicators: "54006f007200630068005c00550073006500720020004400610074006100,4300680072006f006d00690075006d005c00550073006500720020004400610074006100,47006f006f0067006c0065005c004300680072006f006d0065005c00550073006500720020004400610074006100,56006900760061006c00640069005c00550073006500720020004400610074006100,4f007000650072006100200053006f006600740077006100720065005c00,43006f006d006f0064006f005c0044007200610067006f006e005c00550073006500720020004400610074006100,55004300420072006f0077007300650072005c00,4500700069006300200050007200690076006100630079002000420072006f0077007300650072005c00,430065006e007400420072006f0077007300650072005c00550073006500720020004400610074006100,53006c0069006d006a00650074005c00550073006500720020004400610074006100,42006c00690073006b005c00550073006500720020004400610074006100,Edge\User Data,45006400670065005c00550073006500720020004400610074006100,51005100420072006f0077007300650072005c00550073006500720020004400610074006100,420072006100760065002d00420072006f0077007300650072005c00550073006500720020004400610074006100" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore" matched file "warzone file 3.12.exe" as "Detects executables containing SQL queries to confidential data stores. Observed in infostealers" based on indicators: "select ,SELECT ,530045004c004500430054002000, from logins, from cookies, FROM moz_cookies,4e0061006d006500,name,Name,password_value,encrypted_value,isHttpOnly" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM" matched file "warzone file 3.12.exe" as "Detects executables embedding command execution via IExecuteCommand COM object" based on indicators: "Classes\Folder\shell\open\command,DelegateExecute" (Author: ditekSHen)3f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791839896271,"unified_at":"2026-10-12T21:18:16.271Z","metadata":{"hashes":{"sha256":"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6","sha1":"8979f54e3e61532ca734d484e3ce98233a1fdb60","md5":"d343df3654a37b13cf8ede51477a0169","sha512":"56228f0424ba01d6ce82cf0132f65690139d9df70918a1c89d9fc13abf8db0dde79f358c35894c21e69667c6df623e18a0291468b30ca560de409be6ac25cb2a","ssdeep":"12288:xqzi3K/z9wtnRETEK8zukxfWBc0f2fA+CJyi506Hf8y7HNduRtaQ0zSZ8ZlyDDvS:Pn6H7NC8ZlyDL59xBjyzj","ssdeep_chunks":["12288:xqzi3K/","12288:qzi3K/z","12288:zi3K/z9","12288:i3K/z9w","12288:3K/z9wt","12288:K/z9wtn","12288:/z9wtnR","12288:z9wtnRE","12288:9wtnRET","12288:wtnRETE","12288:tnRETEK","12288:nRETEK8","12288:RETEK8z","12288:ETEK8zu","12288:TEK8zuk","12288:EK8zukx","12288:K8zukxf","12288:8zukxfW","12288:zukxfWB","12288:ukxfWBc","12288:kxfWBc0","12288:xfWBc0f","12288:fWBc0f2","12288:WBc0f2f","12288:Bc0f2fA","12288:c0f2fA+","12288:0f2fA+C","12288:f2fA+CJ","12288:2fA+CJy","12288:fA+CJyi","12288:A+CJyi5","12288:+CJyi50","12288:CJyi506","12288:Jyi506H","12288:yi506Hf","12288:i506Hf8","12288:506Hf8y","12288:06Hf8y7","12288:6Hf8y7H","12288:Hf8y7HN","12288:f8y7HNd","12288:8y7HNdu","12288:y7HNduR","12288:7HNduRt","12288:HNduRta","12288:NduRtaQ","12288:duRtaQ0","12288:uRtaQ0z","12288:RtaQ0zS","12288:taQ0zSZ","12288:aQ0zSZ8","12288:Q0zSZ8Z","12288:0zSZ8Zl","12288:zSZ8Zly","12288:SZ8ZlyD","12288:Z8ZlyDD","12288:8ZlyDDv","12288:ZlyDDvS","24576:xqzi3K/","24576:qzi3K/z","24576:zi3K/z9","24576:i3K/z9w","24576:3K/z9wt","24576:K/z9wtn","24576:/z9wtnR","24576:z9wtnRE","24576:9wtnRET","24576:wtnRETE","24576:tnRETEK","24576:nRETEK8","24576:RETEK8z","24576:ETEK8zu","24576:TEK8zuk","24576:EK8zukx","24576:K8zukxf","24576:8zukxfW","24576:zukxfWB","24576:ukxfWBc","24576:kxfWBc0","24576:xfWBc0f","24576:fWBc0f2","24576:WBc0f2f","24576:Bc0f2fA","24576:c0f2fA+","24576:0f2fA+C","24576:f2fA+CJ","24576:2fA+CJy","24576:fA+CJyi","24576:A+CJyi5","24576:+CJyi50","24576:CJyi506","24576:Jyi506H","24576:yi506Hf","24576:i506Hf8","24576:506Hf8y","24576:06Hf8y7","24576:6Hf8y7H","24576:Hf8y7HN","24576:f8y7HNd","24576:8y7HNdu","24576:y7HNduR","24576:7HNduRt","24576:HNduRta","24576:NduRtaQ","24576:duRtaQ0","24576:uRtaQ0z","24576:RtaQ0zS","24576:taQ0zSZ","24576:aQ0zSZ8","24576:Q0zSZ8Z","24576:0zSZ8Zl","24576:zSZ8Zly","24576:SZ8ZlyD","24576:Z8ZlyDD","24576:8ZlyDDv","24576:ZlyDDvS","12288:Pn6H7NC","12288:n6H7NC8","12288:6H7NC8Z","12288:H7NC8Zl","12288:7NC8Zly","12288:NC8ZlyD","12288:C8ZlyDL","12288:8ZlyDL5","12288:ZlyDL59","12288:lyDL59x","12288:yDL59xB","12288:DL59xBj","12288:L59xBjy","12288:59xBjyz","12288:9xBjyzj"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-76939520352728895","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":2166784,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1675860878000,"last_seen":1677663547000,"last_multi_scan":1677663547000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["apt","apt19","c0d0so","codoso","evasive","plugx","stealer","sunshopgroup"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":52},"sandbox_signatures":{"informative_count":93,"suspicious_count":31,"malicious_count":17,"total":141},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65372770","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.IQFY-2569","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65372770 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/TrojanDownloader.Agent.OSQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0059eb261 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.MSIL.Scarsi.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDropper.MSIL.Ader.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Scarsi.Win32.7316","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Execution","technique":"Exploitation for Client Execution","attack_id":"T1203","attack_id_wiki":"https://attack.mitre.org/techniques/T1203","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Contains ability to open/control a service"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Calls an API typically used to create a thread in another process"},{"type":"informative","value":"Contains ability to create thread in the virtual address space of another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Contains ability to write data into process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to detect sandbox (mouse cursor movement)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"Uses powershell with an encoded commandline"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Defense Evasion","technique":"Hidden Users","attack_id":"T1564.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/002","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"suspicious","value":"Contains ability to register/read input devices (often used for keylogging)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks internet related APIs"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"suspicious","value":"Queries process information"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Imports network management related APIs"},{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve is X64 architecture"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query local/system time"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk"},{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to read clipboard data"},{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to take screen capture of the target machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Command and Control","technique":"Data Obfuscation","attack_id":"T1001","attack_id_wiki":"https://attack.mitre.org/techniques/T1001","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Contains ability to download files from the internet"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - Possible RC4 Encryption"},{"type":"informative","value":"Imports Crypto related APIs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"YARA signature match - Possible AES Encryption"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create thread in the virtual address space of another process (API string)","description":"Observed api string:\"CreateRemoteThread\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameW@SHLWAPI.DLL at 00000000-00003696-58374-527-012C929F\n PathFindFileNameW@SHLWAPI.DLL at 00000000-00003696-58374-372-012D4340\n PathFindFileNameW@SHLWAPI.DLL at 00000000-00003400-8368-527-0086929F\n PathFindFileNameW@SHLWAPI.DLL at 00000000-00003400-8368-372-00874340","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write data into process memory (API string)","description":"Observed api string:\"WriteProcessMemory\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function system.reflection.load in a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.bin\n Observed function system.reflection.load in Dppvbouy.exe","origin":"Static Parser","mitre_attack_id":"T1001","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"UnhandledExceptionFilter\" [Source: 00000000-00003400.00000002.74011.009B6000.00000002.mdmp]\n Observed api string:\"SetUnhandledExceptionFilter\" [Source: 00000000-00003400.00000002.74011.009B6000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001796-55296-13-0043344B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001956-263-13-0043344B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Observed api string:\"CryptUnprotectData which can perform decryption and does an integrity check of the data\"[Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1471","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports Crypto related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Sourc%WINDIR%\\exe]","origin":"Static Parser","mitre_attack_id":"T1471","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00002056)\n \"REMCOS 2023.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001796)\n \"Explorer.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001956)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003804)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00000716)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003788)","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Explorer.exe\" called \"GetWindowTextW\" with parameter \"Task Switching\" - (UID: 00000000-00001956)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00002620)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002620)\n \".exe\" called \"RtlGetVersion\" (UID: 00000000-00002620)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00003804)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00000716)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00003788)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\".exe\" called \"LookupAccountSidW\" with parameter \"HAPUBWS\" - (UID: 00000000-00002056)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve is X64 architecture","description":"\".exe\" called \"IsWow64Process\" with parameter \"2620\" - (UID: 00000000-00002620)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"3804\" - (UID: 00000000-00003804)\n \".exe\" called \"IsWow64Process\" with parameter \"2056\" - (UID: 00000000-00002056)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002620)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00003804)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003804)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00003696-58374-629-012D70E4\n GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00003696-58374-228-012C177F\n GetTickCount@KERNEL32.DLL at 00000000-00003696-58374-3-012D9136\n GetTickCount@KERNEL32.DLL at 00000000-00003696-58374-435-012C4BFF\n GetTickCount@KERNEL32.DLL at 00000000-00003696-58374-618-012D3896\n GetTickCount@KERNEL32.DLL at 00000000-00003400-8368-435-00864BFF\n GetTickCount@KERNEL32.DLL at 00000000-00003400-8368-3-00879136\n GetTickCount@KERNEL32.DLL at 00000000-00003400-8368-629-008770E4\n GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00003400-8368-228-0086177F\n GetTickCount@KERNEL32.DLL at 00000000-00003400-8368-618-00873896","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00003696-58374-270-012D4F8B\n FindFirstFileA@KERNEL32.DLL at 00000000-00003696-58374-572-012D0AAE\n FindFirstFileA@KERNEL32.DLL at 00000000-00003400-8368-572-00870AAE\n FindFirstFileW@KERNEL32.DLL at 00000000-00003400-8368-270-00874F8B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00003696-58374-262-012D4E4E\n GetDriveTypeW@KERNEL32.DLL at 00000000-00003400-8368-262-00874E4E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001796-55296-28-004332D6\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001956-263-28-004332D6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001796-55296-28-004332D6\n GetLocalTime@KERNEL32.DLL at 00000000-00003696-58374-532-012CA86E\n GetLocalTime@KERNEL32.DLL at 00000000-00003696-58374-618-012D3896\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001956-263-28-004332D6\n GetLocalTime@KERNEL32.DLL at 00000000-00003400-8368-532-0086A86E\n GetLocalTime@KERNEL32.DLL at 00000000-00003400-8368-618-00873896","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$27","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"GetWindowText\"[Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed api:\"GetForegroundWindow\"[Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed api string:\"RtlGetVersion \" [Source: 58374-81-012D4AF2]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed API string:\"GetStartupInfo\" [Source: 00000000-00003400.00000002.74011.009B6000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":1,"id":"stream-124","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Observed api string:\"PathFileExistsW\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"$29","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe\" at 00000000-00002620-0000010C-959649\n \".exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002620-0000010C-1778998\n \".exe\" queries volume information of \"C:\\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe\" at 00000000-00002056-0000010C-717006","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"REMCOS 2023.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"warzone file 3.12.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"windows.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"powershell.exe\" issued more than 3000 memory allocations","origin":"API Call","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2b","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"5.2.68.82:1198\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Sourc%WINDIR%\\exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: REMCOS 2023.exe)","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"CreateThread\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\12345ME-2V5C4Q\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67110000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 63800000\n \".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67220000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 67D30000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 67780000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$30","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.bin\" has an executable section named \".text\"\n \"windows.exe\" has an executable section named \".text\"\n \"REMCOS 2023.exe\" has an executable section named \".text\"\n \"Dppvbouy.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"windows.exe\" has an writable section named \".data\"\n \"REMCOS 2023.exe\" has an writable section named \".data\"\n \"REMCOS 2023.exe\" has an writable section named \".tls\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$31","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x210600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x2105d4\" greater than 0x100000\n Virtual size of \".data\" is \"0x1351b8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"cmd.exe /C %WINDIR%\\System32\\sdclt.exe\" [Source: 58374-18-012D6B8F]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00002620-00000C0C-5601376411]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==\" [Source: 00000000-00002620-00000C0C-5601376411]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00003804) was launched with modified environment variables: \"Path\"\n Process \".exe\" (UID: 00000000-00002252) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgA ...\" (UID: 00000000-00003804)\n Spawned process \".exe\" (UID: 00000000-00002252)\n Spawned process \".exe\" (UID: 00000000-00002056)\n Spawned process \"REMCOS 2023.exe\" (UID: 00000000-00001796)\n Spawned process \"warzone file 3.12.exe\" (UID: 00000000-00003696)\n Spawned process \"Explorer.exe\" (UID: 00000000-00001956)\n Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\" (UID: 00000000-00000716)\n Spawned process \"windows.exe\" (UID: 00000000-00003400)\n Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\" (UID: 00000000-00003788)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgA ...\" (UID: 00000000-00003804)\n Spawned process \".exe\" (UID: 00000000-00002252)\n Spawned process \".exe\" (UID: 00000000-00002056)\n Spawned process \"REMCOS 2023.exe\" (UID: 00000000-00001796)\n Spawned process \"warzone file 3.12.exe\" (UID: 00000000-00003696)\n Spawned process \"Explorer.exe\" (UID: 00000000-00001956)\n Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\" (UID: 00000000-00000716)\n Spawned process \"windows.exe\" (UID: 00000000-00003400)\n Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\" (UID: 00000000-00003788)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"REMCOS 2023.exe\" connecting to \"\\ThemeApiPort\"\n \"warzone file 3.12.exe\" connecting to \"\\ThemeApiPort\"\n \"windows.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$32","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"windows.exe\" touched file \"%PROGRAMFILES%\\Microsoft DN1\"","origin":"API Call","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$33","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"Explorer.exe\" writes a file \"%ALLUSERSPROFILE%\\1234567ME\\logs.dat\"\n \"Explorer.exe\" writes a file \"%ALLUSERSPROFILE%\\1234567ME\\logs.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Observed api string:\"NetLocalGroupAddMembers which can Creates a local group in the security database\"[Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed api string:\"NetLocalGroupAddMembers which can Adds membership of one or more existing user accounts or global group accounts to an existing local group\"[Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed api string:\"NetUserAdd which can Adds a user account and assigns a password and privilege level\"[Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://microsoft.com/\"\n Heuristic match: \"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\Add-MpPreference.COM\"\n Heuristic match: \"%WINDIR%\\system32\\Add-MpPreference.COM\"\n Heuristic match: \"%WINDIR%\\Add-MpPreference.COM\"\n Heuristic match: \"%WINDIR%\\System32\\Wbem\\Add-MpPreference.COM\"\n Heuristic match: \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Add-MpPreference.COM\"\n Heuristic match: \"C:\\Wireshark\\Add-MpPreference.COM\"\n Heuristic match: \"C:\\Program Files\\Wireshark\\Add-MpPreference.COM\"\n Heuristic match: \"C:\\Users\\HAPUBWS\\AppData\\Local\\Programs\\Python\\Python36-32\\Scripts\\Add-MpPreference.COM\"\n Heuristic match: \"C:\\Users\\HAPUBWS\\AppData\\Local\\Programs\\Python\\Python36-32\\Add-MpPreference.COM\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetLocalGroupAdd\" which can \"Creates a local group in the security database.\" [Sourc%WINDIR%\\exe]\n Observed import api \"NetLocalGroupAddMembers\" which can \"Adds membership of one or more existing user accounts or global group accounts to an existing local group.\" [Sourc%WINDIR%\\exe]\n Observed import api \"NetUserAdd\" which can \"Adds a user account and assigns a password and privilege level.\" [Sourc%WINDIR%\\exe]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Possible AES Encryption","description":"Internal YARA signature for possible AES encryption matched on file \"REMCOS 2023.exe\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Possible RC4 Encryption","description":"Internal YARA signature for possible RC4 encryption matched on file \"windows.exe\"\n Internal YARA signature for possible RC4 encryption matched on file \"REMCOS 2023.exe\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002620)\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003804)\n \".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002056)\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00000716)\n \"windows.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003400)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\".exe\" called \"FindFirstFileW\" (UID: 00000000-00002620)\n \".exe\" called \"FindNextFileW\" (UID: 00000000-00002620)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (mouse cursor movement)","description":"Found GetCursorPos() in an import section (Source: REMCOS 2023.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed api string:\"GetDriveTypeW\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindFirstFileA\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed api string:\"FindNextFileA\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed api string:\"FindFirstFileW\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed api string:\"FindNextFileW\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed api string:\"CreateToolhelp32Snapshot\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed api string:\"Process32NextW\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed api string:\"Process32FirstW\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed api string:\"Process32First\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed api string:\"Process32Next\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Observed api string:\"GetLogicalDriveStringsW\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Observed api string:\"RtlGetVersion\" [Source: 58374-81-012D4AF2]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed api string:\"GetAsyncKeyState\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]\n Observed api string:\"GetKeyState\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed api string:\"GetComputerNameW\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed api string:\"GetSystemMetrics\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to take screen capture of the target machine (API string)","description":"Observed api string:\"CreateCompatibleBitmap\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 58374-373-012D40EF\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 58374-582-012CE1DF","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Sourc%WINDIR%\\exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: REMCOS 2023.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF10a4fc.TMP\" for deletion\n \"powershell.exe\" marked \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF10bd85.TMP\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"System Security","name":"Contains ability to enable or disable privileges in the specified access token (API string)","description":"Observed api string:\"AdjustTokenPrivileges\" [Source: 00000000-00003400.00000002.74011.0087A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed api string:\"SeDebugPrivilege which can Debug programs\"[Source: 58374-606-012D1FF8]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"AllocateAndInitializeSid\" which can \"Allocates and initializes a security identifier (SID) with up to eight subauthorities\" [Sourc%WINDIR%\\exe]\n Observed import api \"FreeSid\" which can \"Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Sourc%WINDIR%\\exe]\n Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Sourc%WINDIR%\\exe]\n Observed import api \"InitializeSecurityDescriptor\" which can \"Initializes a new security descriptor\" [Sourc%WINDIR%\\exe]\n Observed import api \"InitializeSid\" which can \"Initializes a security identifier (SID)\" [Sourc%WINDIR%\\exe]\n Observed import api \"SetSecurityDescriptorDacl\" which can \"Sets information in a discretionary access control list (DACL)\" [Sourc%WINDIR%\\exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"REMCOS 2023.exe\" opened \"\\Device\\KsecDD\"\n \"warzone file 3.12.exe\" opened \"\\Device\\KsecDD\"\n \"Explorer.exe\" opened \"\\Device\\KsecDD\"\n \"windows.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\" (UID: 00000000-00000716)\n Process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\" (UID: 00000000-00003788)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"REMCOS 2023.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\REMCOS 2023.exe]- [targetUID: 00000000-00001796]\n \"warzone file 3.12.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\warzone file 3.12.exe]- [targetUID: 00000000-00003696]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Dppvbouy.exe\" - Location: [%APPDATA%\\Vmavovpfgj\\Dppvbouy.exe]- [targetUID: 00000000-00002620]\n Dropped file: \"AY6AY1EUHVJ36ECBQDA5.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\AY6AY1EUHVJ36ECBQDA5.temp]- [targetUID: 00000000-00003804]\n Dropped file: \"RLBY7XZFY94TL32IWIZK.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\RLBY7XZFY94TL32IWIZK.temp]- [targetUID: 00000000-00000716]\n Dropped file: \"BYXTCR1RBIRTWUS5RAZU.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\BYXTCR1RBIRTWUS5RAZU.temp]- [targetUID: 00000000-00003788]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"windows.exe\" was detected as \"Borland Delphi 3.0 (???)\"\n \"REMCOS 2023.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Dppvbouy.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceW@ADVAPI32.DLL at 00000000-00003696-58374-609-012D2F9E\n OpenServiceW@ADVAPI32.DLL at 00000000-00003696-58374-466-012D30D1\n OpenServiceW@ADVAPI32.DLL at 00000000-00003696-58374-459-012D304C\n OpenServiceW@ADVAPI32.DLL at 00000000-00003400-8368-459-0087304C\n OpenServiceW@ADVAPI32.DLL at 00000000-00003400-8368-466-008730D1\n OpenServiceW@ADVAPI32.DLL at 00000000-00003400-8368-609-00872F9E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1569.002","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00000000-00002056-00000105-1051092\n \"Explorer.exe\" at 00000000-00001956-00000105-432528","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00000000-00002620-00000105-2060968\n \".exe\" queried SystemProcessInformation at 00000000-00002620-00000105-3118352\n \".exe\" queried SystemProcessInformation at 00000000-00002620-00000105-13767424\n \".exe\" queried SystemProcessInformation at 00000000-00002620-00000105-13767983\n \".exe\" queried SystemProcessInformation at 00000000-00002056-00000105-2970205\n \".exe\" queried SystemProcessInformation at 00000000-00002056-00000105-21856992\n \".exe\" queried SystemProcessInformation at 00000000-00002056-00000105-22854906\n \"windows.exe\" queried SystemProcessInformation at 00000000-00003400-00000105-4582980","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses powershell with an encoded commandline","description":"Process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==\" (UID: 00000000-00003804)","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-28","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/22 Antivirus vendors marked sample as malicious (13% detection rate)\n 45/64 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00000000-00003696-58374-4-012D6A31\n LoadResource@KERNEL32.DLL at 00000000-00003696-58374-610-012D47A7\n LoadResource@KERNEL32.DLL at 00000000-00003400-8368-610-008747A7\n LoadResource@KERNEL32.DLL at 00000000-00003400-8368-4-00876A31","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" read file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"windows.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%USERPROFILE%\\Documents\\windows.exe]- [targetUID: 00000000-00003400]\n \"REMCOS 2023.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\REMCOS 2023.exe]- [targetUID: 00000000-00001796]\n \"Explorer.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%ALLUSERSPROFILE%\\ATM Machine\\Explorer.exe]- [targetUID: 00000000-00001796]\n \"Dppvbouy.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\Vmavovpfgj\\Dppvbouy.exe]- [targetUID: 00000000-00002620]\n \"warzone file 3.12.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\warzone file 3.12.exe]- [targetUID: 00000000-00003696]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$37","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\".exe\" wrote 28160 bytes starting with PE header signature to file \"%TEMP%\\REMCOS 2023.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"1.2.3.4\" found in string \"cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q\"\n \"127.0.0.2\"\n \"127.0.0.1\"\n Potential IP \"1.2.3.4\" found in string \"cmd.exe /C ping 1.2.3.4 -n 4 -w 1000 > Nul & cmd.exe /C\"\n \"1.0.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00000000-00003696-58374-603-012D18F9\n recv@WS2_32.DLL at 00000000-00003696-58374-624-012D3D7E\n recv@WS2_32.DLL at 00000000-00003696-58374-602-012D188C\n recv@WS2_32.DLL at 00000000-00003696-58374-12-012C605B\n recv@WS2_32.DLL at 00000000-00003696-58374-526-012C7D2F\n URLDownloadToFileW@URLMON.DLL at 00000000-00003696-58374-342-012C205E\n recv@WS2_32.DLL at 00000000-00003696-58374-622-012D3C4E\n URLDownloadToFileW@URLMON.DLL at 00000000-00003400-8368-342-0086205E\n recv@WS2_32.DLL at 00000000-00003400-8368-526-00867D2F\n recv@WS2_32.DLL at 00000000-00003400-8368-622-00873C4E\n recv@WS2_32.DLL at 00000000-00003400-8368-602-0087188C\n recv@WS2_32.DLL at 00000000-00003400-8368-603-008718F9\n recv@WS2_32.DLL at 00000000-00003400-8368-12-0086605B\n recv@WS2_32.DLL at 00000000-00003400-8368-624-00873D7E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1105","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"root\\CIMV2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Explorer.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"windows.exe\" called \"Process32FirstW\" (UID: 00000000-00003400)\n \"windows.exe\" called \"Process32NextW\" (UID: 00000000-00003400)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002620)\n \"powershell.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003804)\n \".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002056)\n \"REMCOS 2023.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00001796)\n \"warzone file 3.12.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003696)\n \"powershell.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00000716)\n \"windows.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003400)\n \"powershell.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003788)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"Process32FirstW@KERNEL32.DLL at 00000000-00003696-58374-282-012D5B96\n Process32FirstW@KERNEL32.DLL at 00000000-00003696-58374-279-012C1BA7\n Process32Next@KERNEL32.DLL at 00000000-00003696-58374-58-012D73F1\n Process32FirstW@KERNEL32.DLL at 00000000-00003696-58374-253-012D5C5D\n Process32FirstW@KERNEL32.DLL at 00000000-00003400-8368-279-00861BA7\n Process32FirstW@KERNEL32.DLL at 00000000-00003400-8368-282-00875B96\n Process32FirstW@KERNEL32.DLL at 00000000-00003400-8368-253-00875C5D\n Process32Next@KERNEL32.DLL at 00000000-00003400-8368-58-008773F1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00000000-00003696-58374-536-012D73AB\n OpenClipboard@USER32.DLL at 00000000-00003400-8368-536-008773AB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to read clipboard data","description":"GetClipboardData@USER32.DLL at 00000000-00003696-58374-536-012D73AB\n GetClipboardData@USER32.DLL at 00000000-00003400-8368-536-008773AB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":5,"id":"stream-74","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (often used for keylogging)","description":"RegisterRawInputDevices@USER32.DLL at 00000000-00003696-58374-534-012CADCA\n RegisterRawInputDevices@USER32.DLL at 00000000-00003400-8368-534-0086ADCA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056","relevance":10,"id":"stream-16","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.DLL at 00000000-00003696-58374-533-012CAAFD\n GetKeyboardState@USER32.DLL at 00000000-00003696-58374-107-012CAC4F\n GetKeyState@USER32.DLL at 00000000-00003696-58374-534-012CADCA\n GetKeyState@USER32.DLL at 00000000-00003400-8368-534-0086ADCA\n GetKeyboardState@USER32.DLL at 00000000-00003400-8368-533-0086AAFD\n GetKeyboardState@USER32.DLL at 00000000-00003400-8368-107-0086AC4F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00003696-58374-1-012C679E\n GetCommandLineA@KERNEL32.DLL at 00000000-00003400-8368-1-0086679E\n GetCommandLineA@KERNEL32.dll at 61167-1-0040679E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"$38","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"REMCOS 2023.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")\n \"Explorer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$3a","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"REMCOS 2023.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"REMCOS 2023.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$3b","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$3c","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.bin\" claims program is from Sat Dec 17 18:00:14 2095\n \"Dppvbouy.exe\" claims program is from Sat Dec 17 18:00:14 2095","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to create a thread in another process","description":"\"windows.exe\" called \"CreateRemoteThread\" (UID: 00000000-00003400)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessA\" with parameter \"C:\\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe\" - (UID: 00000000-00002620)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"PE file contains executable resources","description":"windows.exe has PE file in resource with name: \"WM_DSP\" and filetype:PE32 executable (GUI) Intel 80386\n for MS Windows","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"warzone file 3.12.exe\" opened \"%TEMP%\\warzone file 3.12.exe:Zone.Identifier\" with delete access\n \"warzone file 3.12.exe\" opened \"%TEMP%\\warzone file 3.12.exe:ZONE.IDENTIFIER\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"45/64 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"53/85 Antivirus vendors marked dropped file \"windows.exe\" as malicious (classified as \"Dropped:Generic.Malware.SFlg\" with 62% detection rate)\n 52/68 Antivirus vendors marked dropped file \"REMCOS 2023.exe\" as malicious (classified as \"Generic.Remcos\" with 76% detection rate)\n 52/68 Antivirus vendors marked dropped file \"Explorer.exe\" as malicious (classified as \"Generic.Remcos\" with 76% detection rate)\n 45/80 Antivirus vendors marked dropped file \"Dppvbouy.exe\" as malicious (classified as \"HEUR:Trojan.MSIL.Scarsi\" with 56% detection rate)\n 53/85 Antivirus vendors marked dropped file \"warzone file 3.12.exe\" as malicious (classified as \"Dropped:Generic.Malware.SFlg\" with 62% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"45/80 Antivirus vendors marked spawned process \".exe\" (PID: 2252) as malicious (classified as \"HEUR:Trojan.MSIL.Scarsi\" with 56% detection rate)\n 45/80 Antivirus vendors marked spawned process \".exe\" (PID: 2056) as malicious (classified as \"HEUR:Trojan.MSIL.Scarsi\" with 56% detection rate)\n 52/68 Antivirus vendors marked spawned process \"REMCOS 2023.exe\" (PID: 1796) as malicious (classified as \"Generic.Remcos\" with 76% detection rate)\n 53/85 Antivirus vendors marked spawned process \"warzone file 3.12.exe\" (PID: 3696) as malicious (classified as \"Dropped:Generic.Malware.SFlg\" with 62% detection rate)\n 52/68 Antivirus vendors marked spawned process \"Explorer.exe\" (PID: 1956) as malicious (classified as \"Generic.Remcos\" with 76% detection rate)\n 53/85 Antivirus vendors marked spawned process \"windows.exe\" (PID: 3400) as malicious (classified as \"Dropped:Generic.Malware.SFlg\" with 62% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"warzone file 3.12.exe\" allocated memory in \"%USERPROFILE%\\Documents\\windows.exe\"\n \"warzone file 3.12.exe\" allocated memory in \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"\n \"windows.exe\" allocated memory in \"%WINDIR%\\System32\\mswsock.dll\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$3d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 5.2.68.82 on port 1198","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$3e","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Generic Stealer","description":"Internal YARA signature Malware.Stealer matched on file \"windows.exe\"","origin":"YARA Signature","relevance":10,"id":"yara-8","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"\\Google\\Chrome\\User Data\\Default\\History\" (Indicator: \"\\google\\chrome\\\") in Source: 58374-561-012CCD85\n \"\\Google\\Chrome\\User Data\\Local State\" (Indicator: \"\\google\\chrome\\\") in Source: 58374-540-012CBEEB\n \"\\Google\\Chrome\\User Data\\Default\\Login Data\" (Indicator: \"\\google\\chrome\\\") in Source: 58374-540-012CBEEB\n \"Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\" (Indicator: \"\\google\\chrome\\\") in Source: 58374-362-012C22D8\n \"\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\" (Indicator: \"\\google\\chrome\\\") in Source: 58374-565-012CDC9D\n \"\\Chromium\\User Data\\Local State\" (Indicator: \"\\chromium\\\") in Source: 58374-565-012CDC9D\n \"\\Chromium\\User Data\\Default\\Login Data\" (Indicator: \"\\chromium\\\") in Source: 58374-565-012CDC9D\n \"\\Comodo\\Dragon\\User Data\\Local State\" (Indicator: \"\\comodo\\\") in Source: 58374-565-012CDC9D\n \"\\Comodo\\Dragon\\User Data\\Default\\Login Data\" (Indicator: \"\\comodo\\\") in Source: 58374-565-012CDC9D","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"HttpOpenRequestW@WININET.DLL\" in \".exe\"\n \"InternetReadFile@WININET.DLL\" in \".exe\"\n \"InternetOpenA@WININET.DLL\" in \".exe\"\n \"InternetOpenW@WININET.DLL\" in \".exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \".exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00000000-00002620)\n Spawned process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==\" (UID: 00000000-00003804)\n Spawned process \".exe\" (UID: 00000000-00002252)\n Spawned process \".exe\" (UID: 00000000-00002056)\n Spawned process \"REMCOS 2023.exe\" (UID: 00000000-00001796)\n Spawned process \"warzone file 3.12.exe\" (UID: 00000000-00003696)\n Spawned process \"Explorer.exe\" (UID: 00000000-00001956)\n Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\" (UID: 00000000-00000716)\n Spawned process \"windows.exe\" (UID: 00000000-00003400)\n Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\" (UID: 00000000-00003788)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"Spyware","details_count":7,"details":[{"detail":"Hooks API calls"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Contains ability to register/read input devices (often used for keylogging)"},{"detail":"Contains ability to read clipboard data"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the windows installation language"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Contains ability to change service configuration"},{"detail":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]}]},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":118,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["apt","apt19","c0d0so","codoso","evasive","plugx","stealer","sunshopgroup"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"63e7af8735b5995b6e431977","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["NLD"],"submit_name":"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe","analysis_start_time":"2023-02-11T15:08:56+00:00","indicators_count":{"informative":93,"suspicious":66,"malicious":24},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"5.2.68.82","port":1198,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}],"processes":[{"pid":2620,"ppid":0,"name":"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe","command_line":"","sha256":"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6","normalized_path":"C:\\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe","uid":"00000000-00002620","icon":"$3f"},{"pid":3804,"ppid":2620,"name":"powershell.exe","command_line":"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002620","uid":"00000000-00003804"},{"pid":2252,"ppid":2620,"name":"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe","command_line":"","sha256":"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6","normalized_path":"C:\\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe","parent_uid":"00000000-00002620","uid":"00000000-00002252"},{"pid":2056,"ppid":2620,"name":"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe","command_line":"","sha256":"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6","normalized_path":"C:\\a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6.exe","parent_uid":"00000000-00002620","uid":"00000000-00002056"},{"pid":1796,"ppid":2056,"name":"REMCOS 2023.exe","command_line":"","sha256":"6713faaedb6fc283b3ac7ce13457aa0ef5be4d9065e297b0d03c9bb2f1b73991","normalized_path":"%TEMP%\\REMCOS 2023.exe","parent_uid":"00000000-00002056","uid":"00000000-00001796"},{"pid":1956,"ppid":1796,"name":"Explorer.exe","command_line":"","sha256":"6713faaedb6fc283b3ac7ce13457aa0ef5be4d9065e297b0d03c9bb2f1b73991","normalized_path":"%ALLUSERSPROFILE%\\ATM Machine\\Explorer.exe","parent_uid":"00000000-00001796","uid":"00000000-00001956"},{"pid":3696,"ppid":2056,"name":"warzone file 3.12.exe","command_line":"","sha256":"6b4ec9d1a735fa22099040c27d02eef9be4913b84dfd01fbf032e0fcafa89c8e","normalized_path":"%TEMP%\\warzone file 3.12.exe","parent_uid":"00000000-00002056","uid":"00000000-00003696"},{"pid":716,"ppid":3696,"name":"powershell.exe","command_line":"powershell Add-MpPreference -ExclusionPath C:\\","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003696","uid":"00000000-00000716"},{"pid":3400,"ppid":3696,"name":"windows.exe","command_line":"","sha256":"6b4ec9d1a735fa22099040c27d02eef9be4913b84dfd01fbf032e0fcafa89c8e","normalized_path":"%USERPROFILE%\\Documents\\windows.exe","parent_uid":"00000000-00003696","uid":"00000000-00003400"},{"pid":3788,"ppid":3400,"name":"powershell.exe","command_line":"powershell Add-MpPreference -ExclusionPath C:\\","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003400","uid":"00000000-00003788"}],"all_imported_dlls":["api-ms-win-downlevel-version-l1-1-0.dll","iertutil.dll","ntmarta.dll","ole32.dll","apphelp.dll","psapi.dll","srvcli.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","shdocvw.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","normaliz.dll","shell32.dll","Microsoft.WSMan.Runtime.dll","tzres.dll","ws2_32.dll","api-ms-win-core-synch-l1-2-0.dll","System.Numerics.ni.dll","userenv.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","Microsoft.WSMan.Management.ni.dll","Microsoft.VisualBasic.ni.dll","RpcRtRemote.dll","samcli.dll","System.Transactions.dll","System.Management.ni.dll","profapi.dll","cscapi.dll","cryptsp.dll","devenum.dll","Microsoft.PowerShell.Commands.Management.ni.dll","kernel32.dll","gdi32.dll","oleaut32.dll","comctl32.dll","cfgmgr32.dll","rsaenh.dll","advapi32.dll","mscoreei.dll","uxtheme.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","usp10.dll","linkinfo.dll","System.Core.ni.dll","crypt32.dll","Wldap32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","urlmon.dll","System.Management.Automation.ni.dll","wintrust.dll","sechost.dll","lpk.dll","netapi32.dll","shlwapi.dll","nlssorting.dll","ntshrui.dll","shfolder.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","winmm.dll","WSHTCPIP.DLL","vcruntime140_clr0400.dll","mscorlib.ni.dll","secur32.dll","mscorrc.dll","msctf.dll","atl.dll","mscorwks.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","imm32.dll","System.Configuration.Install.ni.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","bcrypt.dll","Microsoft.PowerShell.Security.ni.dll","GdiPlus.dll","msvfw32.dll","ieframe.dll","nsi.dll","System.Data.dll","msdmo.dll","rpcrt4.dll","sspicli.dll","devobj.dll","ntdll.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","mscoree.dll","wpdshext.dll","System.Runtime.Serialization.ni.dll","msasn1.dll","wininet.dll","System.Data.ni.dll","webservices.dll","version.dll","msvcrt.dll","user32.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Management.Automation.dll","System.DirectoryServices.ni.dll","avicap32.dll","setupapi.dll","System.Transactions.ni.dll","netutils.dll","diasymreader.dll","rpcss.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","ucrtbase_clr0400.dll","propsys.dll","msvcr80.dll","clbcatq.dll","cryptbase.dll","clrjit.dll","clr.dll","slc.dll","mswsock.dll","wkscli.dll","KernelBase.dll","fltLib.dll","System.ni.dll","System.Xml.ni.dll","mscorjit.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Explorer.exe","sha256":"6713faaedb6fc283b3ac7ce13457aa0ef5be4d9065e297b0d03c9bb2f1b73991","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"Dppvbouy.exe","sha256":"a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"REMCOS 2023.exe","sha256":"6713faaedb6fc283b3ac7ce13457aa0ef5be4d9065e297b0d03c9bb2f1b73991","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"warzone file 3.12.exe","sha256":"6b4ec9d1a735fa22099040c27d02eef9be4913b84dfd01fbf032e0fcafa89c8e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"windows.exe","sha256":"6b4ec9d1a735fa22099040c27d02eef9be4913b84dfd01fbf032e0fcafa89c8e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"logs.dat","sha256":"36aa215d9afed1e75799daa325868b910bf74b930c50ef2c27fffde39bac3260","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"AY6AY1EUHVJ36ECBQDA5.temp","sha256":"bc780edefac6823bce6b8f4fb48524850641ba28aaed3f81e129907eec666278","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"BYXTCR1RBIRTWUS5RAZU.temp","sha256":"17cb08f9d13ef06f3361c8b2ccf53ffbc471b024aef23218b508266cf06f65c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"RLBY7XZFY94TL32IWIZK.temp","sha256":"616835d0fa3f1937449298edb6d124b730755a9779688b57ca2f3e6457ef5430","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]}],"files_written":[{"path":"%APPDATA%\\Vmavovpfgj\\Dppvbouy.exe","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"path":"%ALLUSERSPROFILE%\\ATM Machine","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"path":"%USERPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"path":"%PROGRAMFILES%\\Microsoft DN1","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"path":"%ALLUSERSPROFILE%\\1234567ME","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"key":"HKCU\\SOFTWARE\\12345ME-2V5C4Q\\\\","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\12345ME-2V5C4Q","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"12345ME-2V5C4Q","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"63e7af8735b5995b6e431977"}]}]}},"report_ids":{"sandbox_job_ids":["63e7af8735b5995b6e431977"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample a8b1d5171c2a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a8b1d5171c2a…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 17 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample a8b1d5171c2a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a8b1d5171c2a…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 17 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a8b1d5171c2a80ef5decd6eb87655159a6268984ff9a89304df515a0248b91e6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample a8b1d5171c2a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a8b1d5171c2a…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 17 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L40","11",{}]]