23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.MSILZilla Sample b52dfce5f89a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b52dfce5f89a…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/28 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b52dfce5f89a429888f35bf530eb9efc6d24431f606f1a98795ee13f2c9b1c79","keywords":["Malicious","IL:Trojan.MSILZilla","malware analysis","sandbox report","threat intelligence","b52dfce5f89a429888f35bf530eb9efc6d24431f606f1a98795ee13f2c9b1c79"],"about":{"@type":"SoftwareApplication","name":"HITMAN.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"b52dfce5f89a429888f35bf530eb9efc6d24431f606f1a98795ee13f2c9b1c79","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.MSILZilla","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T64d,"" loaded module "ADVAPI32.DLL" at base 77080000 "" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 60340000 "" loaded module "CRYPTSP.DLL" at base 75560000 "" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75300000 "" loaded module "CRYPTBASE.DLL" at base 75A30000 "" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\9E0A3B9B9F457233A335D7FBA8F95419\SYSTEM.NI.DLL" at base 6A930000 "" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALBAS#\08D608378AA405ADC844F3CF36974B8C\MICROSOFT.VISUALBASIC.NI.DLL" at base 6B3E0000 "" loaded module "PSAPI.DLL" at base 77B30000 "" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\DBFE8642A8ED7B2B103AD28E0C96418A\SYSTEM.DRAWING.NI.DLL" at base 6A510000 "" loaded module "GDIPLUS.DLL" at base 74690000 "" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74820000 "" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL" at base 74690000 "" loaded module "WINDOWSCODECS.DLL" at base 742F0000 "" loaded module "BCRYPT.DLL" at base 75670000 "" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\BC09AD2D49D8535371845CD7532F9271\SYSTEM.CONFIGURATION.NI.DLL" at base 6A1E0000 "" loaded module "SHFOLDER.DLL" at base 6A8B000025:T6b2,"/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" on 2016-04-02.06:58:20 "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" on 2016-04-02.06:58:25 "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" on 2016-04-02.06:58:30 "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" on 2016-04-02.06:59:34 "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" on 2016-04-02.06:59:40 "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" on 2016-04-02.06:59:47 "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" on 2016-04-02.06:59:52 "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" on 2016-04-02.06:59:56 "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" on 2016-04-02.07:00:01 "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" on 2016-04-02.07:00:06 "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" on 2016-04-02.07:00:1126:Te7c,Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00178234-00004068) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00179781-00003640) Spawned process "nwtray.exe" (UID: 00180343-00003840) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00183515-00003632) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00184828-00003008) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00188265-00003560) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00189562-00003212) Spawned process "nvvswc.exe" (UID: 00228125-00002920) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00252687-00003172) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00254546-00003104) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00258234-00003372) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00259531-00003184) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00266000-00001668) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00267265-00001604) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00270859-00002120) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00272000-00002072) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00275187-00002556) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00276312-00002168) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00280109-00001392) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00281265-00001080)27:T62b,"" created file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp" "" created file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp" "" created file "C:\Windows\assembly\pubpol15.dat" "" created file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\machine.config" "" created file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll" "" created file "C:\Windows\system32\rsaenh.dll" "" created file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config" "" created file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "" created file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" created file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" created file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" "nvvswc.exe" created file "C:\Windows\assembly\pubpol15.dat" "nvvswc.exe" created file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\machine.config" "nvvswc.exe" created file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "nvvswc.exe" created file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "nvvswc.exe" created file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" "nvvswc.exe" created file "C:\Windows\System32" "nvvswc.exe" created file "C:\Windows\System32\cmd.exe"28:T4b0,"" opened "Z:\HITMAN.exe:Zone.Identifier" with delete access "" opened "%APPDATA%\WinRAR\nvvswc.exe:Zone.Identifier" with delete access "" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.2628.3720343" with delete access "" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.2628.3720359" with delete access "" opened "%APPDATA%\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2628.3720593" with delete access "nvvswc.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.3780.3764453" with delete access "nvvswc.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.3780.3764453" with delete access "nvvswc.exe" opened "%APPDATA%\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.3780.3765093" with delete access "nwtray.exe" opened "%APPDATA%\WinRAR\nwtray.exe:Zone.Identifier" with delete access "nwtray.exe" opened "%APPDATA%\WinRAR\nvvswc.exe:Zone.Identifier" with delete access "nwtray.exe" opened "%APPDATA%\WinRAR\nwtray.exe" with delete access29:T74a,"" wrote 1500 bytes to a foreign process "RegAsm.exe" (PID: 00002840) "" wrote 4 bytes to a foreign process "RegAsm.exe" (PID: 00002840) "" wrote 32 bytes to a foreign process "RegAsm.exe" (PID: 00002840) "" wrote 52 bytes to a foreign process "RegAsm.exe" (PID: 00002840) "" wrote 512 bytes to a foreign process "RegAsm.exe" (PID: 00002840) "" wrote 467967 bytes to a foreign process "RegAsm.exe" (PID: 00002840) "" wrote 511 bytes to a foreign process "RegAsm.exe" (PID: 00002840) "" wrote 32 bytes to a foreign process "nvvswc.exe" (PID: 00003780) "" wrote 52 bytes to a foreign process "nvvswc.exe" (PID: 00003780) "" wrote 4 bytes to a foreign process "nvvswc.exe" (PID: 00003780) "nvvswc.exe" wrote 32 bytes to a foreign process "nwtray.exe" (PID: 00003840) "nvvswc.exe" wrote 52 bytes to a foreign process "nwtray.exe" (PID: 00003840) "nvvswc.exe" wrote 4 bytes to a foreign process "nwtray.exe" (PID: 00003840) "nwtray.exe" wrote 1500 bytes to a foreign process "RegAsm.exe" (PID: 00003740) "nwtray.exe" wrote 4 bytes to a foreign process "RegAsm.exe" (PID: 00003740) "nwtray.exe" wrote 32 bytes to a foreign process "RegAsm.exe" (PID: 00003740) "nwtray.exe" wrote 52 bytes to a foreign process "RegAsm.exe" (PID: 00003740) "nwtray.exe" wrote 512 bytes to a foreign process "RegAsm.exe" (PID: 00003740) "nwtray.exe" wrote 467967 bytes to a foreign process "RegAsm.exe" (PID: 00003740) "nwtray.exe" wrote 511 bytes to a foreign process "RegAsm.exe" (PID: 00003740) "nwtray.exe" wrote 32 bytes to a foreign process "nvvswc.exe" (PID: 00002920) "nwtray.exe" wrote 52 bytes to a foreign process "nvvswc.exe" (PID: 00002920) "nwtray.exe" wrote 4 bytes to a foreign process "nvvswc.exe" (PID: 00002920)2a:T580,NtAlertResumeThread@NTDLL.DLL at 00116453-00002628-779F228D-140533 NtGetContextThread@NTDLL.DLL at 00116453-00002628-779F228D-140535 NtSetContextThread@NTDLL.DLL at 00116453-00002628-779F228D-140547 NtUnmapViewOfSection@NTDLL.DLL at 00116453-00002628-779F228D-140549 NtWriteVirtualMemory@NTDLL.DLL at 00116453-00002628-779F228D-140563 NtQuerySystemInformation@NTDLL.DLL at 00116453-00002628-779F228D-141206 NtQuerySystemInformationW@NTDLL.DLL at 00116453-00002628-779F228D-141218 NtQuerySystemInformation@NTDLL.DLL at 00161125-00003780-779F228D-169018 NtQuerySystemInformationW@NTDLL.DLL at 00161125-00003780-779F228D-169022 NtSetSystemInformation@NTDLL.DLL at 00161125-00003780-779F228D-169275 NtAlertResumeThread@NTDLL.DLL at 00180343-00003840-779F228D-203204 NtGetContextThread@NTDLL.DLL at 00180343-00003840-779F228D-203218 NtSetContextThread@NTDLL.DLL at 00180343-00003840-779F228D-203235 NtUnmapViewOfSection@NTDLL.DLL at 00180343-00003840-779F228D-203251 NtWriteVirtualMemory@NTDLL.DLL at 00180343-00003840-779F228D-203266 NtQuerySystemInformation@NTDLL.DLL at 00180343-00003840-779F228D-204079 NtQuerySystemInformationW@NTDLL.DLL at 00180343-00003840-779F228D-204080 NtQuerySystemInformation@NTDLL.DLL at 00228125-00002920-779F228D-234993 NtQuerySystemInformationW@NTDLL.DLL at 00228125-00002920-779F228D-234998 NtSetSystemInformation@NTDLL.DLL at 00228125-00002920-779F228D-2351762b:T120e,Spawned process "" (UID: 00116453-00002628) Spawned process "nvvswc.exe" (UID: 00161125-00003780) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00178234-00004068) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00179781-00003640) Spawned process "nwtray.exe" (UID: 00180343-00003840) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00183515-00003632) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00184828-00003008) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00188265-00003560) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00189562-00003212) Spawned process "nvvswc.exe" (UID: 00228125-00002920) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00252687-00003172) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00254546-00003104) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00258234-00003372) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00259531-00003184) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00266000-00001668) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00267265-00001604) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00270859-00002120) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00272000-00002072) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00275187-00002556) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00276312-00002168) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00280109-00001392) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00281265-00001080) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00285015-00002256) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00286203-00000356) Spawned process "cmd.exe" with commandline "/c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00289593-00002064) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "%APPDATA%\WinRAR\nvvswc.exe" /f" (UID: 00290703-00001232)1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"b52dfce5f89a429888f35bf530eb9efc6d24431f606f1a98795ee13f2c9b1c79","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792396734899,"unified_at":"2026-10-19T07:58:54.899Z","metadata":{"hashes":{"sha256":"b52dfce5f89a429888f35bf530eb9efc6d24431f606f1a98795ee13f2c9b1c79","sha1":"106f65043a9480b41cf97214f746b5eb032e9651","md5":"775b7139d05281094ab6434378770483","sha512":"da938d0df19491bb1844c94a3270706e7dd5164c3ff35cd1c219f2ef853769895b25bad4633562ab5873e6bca0006aa6e0e152bc207efc760c2adaf44402f148","ssdeep":"12288:RCaOOJ8dPZn+a+WrcVqxUThWvr8DfTV9s54vmWaEDXRy3LCE6FZl4IUkbuuA0XS:RC/PkW7xUer4s54vmWRtFEwKkyaS","ssdeep_chunks":["12288:RCaOOJ8","12288:CaOOJ8d","12288:aOOJ8dP","12288:OOJ8dPZ","12288:OJ8dPZn","12288:J8dPZn+","12288:8dPZn+a","12288:dPZn+a+","12288:PZn+a+W","12288:Zn+a+Wr","12288:n+a+Wrc","12288:+a+WrcV","12288:a+WrcVq","12288:+WrcVqx","12288:WrcVqxU","12288:rcVqxUT","12288:cVqxUTh","12288:VqxUThW","12288:qxUThWv","12288:xUThWvr","12288:UThWvr8","12288:ThWvr8D","12288:hWvr8Df","12288:Wvr8DfT","12288:vr8DfTV","12288:r8DfTV9","12288:8DfTV9s","12288:DfTV9s5","12288:fTV9s54","12288:TV9s54v","12288:V9s54vm","12288:9s54vmW","12288:s54vmWa","12288:54vmWaE","12288:4vmWaED","12288:vmWaEDX","12288:mWaEDXR","12288:WaEDXRy","12288:aEDXRy3","12288:EDXRy3L","12288:DXRy3LC","12288:XRy3LCE","12288:Ry3LCE6","12288:y3LCE6F","12288:3LCE6FZ","12288:LCE6FZl","12288:CE6FZl4","12288:E6FZl4I","12288:6FZl4IU","12288:FZl4IUk","12288:Zl4IUkb","12288:l4IUkbu","12288:4IUkbuu","12288:IUkbuuA","12288:UkbuuA0","12288:kbuuA0X","12288:buuA0XS","24576:RCaOOJ8","24576:CaOOJ8d","24576:aOOJ8dP","24576:OOJ8dPZ","24576:OJ8dPZn","24576:J8dPZn+","24576:8dPZn+a","24576:dPZn+a+","24576:PZn+a+W","24576:Zn+a+Wr","24576:n+a+Wrc","24576:+a+WrcV","24576:a+WrcVq","24576:+WrcVqx","24576:WrcVqxU","24576:rcVqxUT","24576:cVqxUTh","24576:VqxUThW","24576:qxUThWv","24576:xUThWvr","24576:UThWvr8","24576:ThWvr8D","24576:hWvr8Df","24576:Wvr8DfT","24576:vr8DfTV","24576:r8DfTV9","24576:8DfTV9s","24576:DfTV9s5","24576:fTV9s54","24576:TV9s54v","24576:V9s54vm","24576:9s54vmW","24576:s54vmWa","24576:54vmWaE","24576:4vmWaED","24576:vmWaEDX","24576:mWaEDXR","24576:WaEDXRy","24576:aEDXRy3","24576:EDXRy3L","24576:DXRy3LC","24576:XRy3LCE","24576:Ry3LCE6","24576:y3LCE6F","24576:3LCE6FZ","24576:LCE6FZl","24576:CE6FZl4","24576:E6FZl4I","24576:6FZl4IU","24576:FZl4IUk","24576:Zl4IUkb","24576:l4IUkbu","24576:4IUkbuu","24576:IUkbuuA","24576:UkbuuA0","24576:kbuuA0X","24576:buuA0XS","12288:RC/PkW7","12288:C/PkW7x","12288:/PkW7xU","12288:PkW7xUe","12288:kW7xUer","12288:W7xUer4","12288:7xUer4s","12288:xUer4s5","12288:Uer4s54","12288:er4s54v","12288:r4s54vm","12288:4s54vmW","12288:s54vmWR","12288:54vmWRt","12288:4vmWRtF","12288:vmWRtFE","12288:mWRtFEw","12288:WRtFEwK","12288:RtFEwKk","12288:tFEwKky","12288:FEwKkya","12288:EwKkyaS"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"HITMAN.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1060352,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295335000,"last_seen":1677386390000,"last_multi_scan":1677386390000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":15,"malicious_count":9,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1234902","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILZilla.92288","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILZilla.92288 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Injector.OSU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!38B27351F76DC83A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004e1fcb1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-PSW.MSIL.Stealer.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FIFC!775B7139D052","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Stealer.ebjlyh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL9.COES","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Injector.Win32.370348","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"IL:Trojan.MSILZilla","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"files.catbox.moe\"\n \"latehost.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"213.183.58.47:14221\"\n \"213.183.58.47:0\"\n \"66.150.188.176:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /do3aqb.gifv HTTP/1.1\nHost: files.catbox.moe\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$24","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 687F0000\n \"nvvswc.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 687F0000\n \"nwtray.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 687F0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"CloseEventLog@ADVAPI32.dll\"\n \"LoadLibraryShim_RetAddr@mscoreei.dll\"\n \"LoadLibraryShim@mscoreei.dll\"\n \"ConvertLangIdToCultureName@culture.dll\"\n \"CryptAcquireContextW@CRYPTSP.dll\"\n \"CPAcquireContext@rsaenh.dll\"\n \"CPReleaseContext@rsaenh.dll\"\n \"CPGenKey@rsaenh.dll\"\n \"CPDeriveKey@rsaenh.dll\"\n \"CPDestroyKey@rsaenh.dll\"\n \"CPSetKeyParam@rsaenh.dll\"\n \"CPGetKeyParam@rsaenh.dll\"\n \"CPExportKey@rsaenh.dll\"\n \"CPImportKey@rsaenh.dll\"\n \"CPEncrypt@rsaenh.dll\"\n \"CPDecrypt@rsaenh.dll\"\n \"CPCreateHash@rsaenh.dll\"\n \"CPHashData@rsaenh.dll\"\n \"CPHashSessionKey@rsaenh.dll\"\n \"CPDestroyHash@rsaenh.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$25","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"nvvswc.exe\" connecting to \"\\ThemeApiPort\"\n \"nwtray.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00116453-00002628-779F228D-159928\n LookupAccountNameLocalW@SECHOST.DLL at 00116453-00002628-779F228D-160613\n GetUserNameExW@SSPICLI.DLL at 00161125-00003780-779F228D-176422\n LookupAccountNameLocalW@SECHOST.DLL at 00161125-00003780-779F228D-177437\n GetUserNameExW@SSPICLI.DLL at 00180343-00003840-779F228D-225672\n LookupAccountNameLocalW@SECHOST.DLL at 00180343-00003840-779F228D-227268\n GetUserNameExW@SSPICLI.DLL at 00228125-00002920-779F228D-250627\n LookupAccountNameLocalW@SECHOST.DLL at 00228125-00002920-779F228D-252109","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"nwtray.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"nvvswc.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.95054555461","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"nvvswc.exe\" (Thread ID: 3276) slept \"220\" times (threshold: 200)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"nwtray.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds\n \"nvvswc.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"nvvswc.exe\" read file \"%USERPROFILE%\\Users\\PSPUBWS\\Searches\\desktop.ini\"\n \"nvvswc.exe\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \"nvvswc.exe\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \"nvvswc.exe\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"nwtray.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"nvvswc.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.118.0.0\"\n \"2.10.5.2\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%APPDATA%\\WinRAR\\nwtray.exe\" marked \"%APPDATA%\\WinRAR\\nwtray.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$28","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"nvvswc.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"nvvswc.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"nwtray.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"nwtray.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"52AB738B\" to virtual address \"0x692F1FDC\" (part of module \"MSCORWKS.DLL\")\n \"nvvswc.exe\" wrote bytes \"86EE4E8F\" to virtual address \"0x692F1FDC\" (part of module \"MSCORWKS.DLL\")\n \"nwtray.exe\" wrote bytes \"3B013F9E\" to virtual address \"0x692F1FDC\" (part of module \"MSCORWKS.DLL\")\n \"nvvswc.exe\" wrote bytes \"52EB9DE5\" to virtual address \"0x692F1FDC\" (part of module \"MSCORWKS.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"\" opened \"Z:\\HITMAN.exe:Zone.Identifier\" with delete access\n \"\" opened \"%APPDATA%\\WinRAR\\nvvswc.exe:Zone.Identifier\" with delete access\n \"nwtray.exe\" opened \"%APPDATA%\\WinRAR\\nwtray.exe:Zone.Identifier\" with delete access\n \"nwtray.exe\" opened \"%APPDATA%\\WinRAR\\nvvswc.exe:Zone.Identifier\" with delete access","origin":"API Call","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/56 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00001500 bytes of memory in \"RegAsm.exe\" (Protection: \"read/write\")\n \"\" allocated 00000088 bytes of memory in \"RegAsm.exe\" (Protection: \"read/write\")\n \"\" allocated 00499712 bytes of memory in \"RegAsm.exe\" (Protection: \"execute/read/write\")\n \"\" allocated 00000088 bytes of memory in \"nvvswc.exe\" (Protection: \"read/write\")\n \"nvvswc.exe\" allocated 00000088 bytes of memory in \"cmd.exe\" (Protection: \"read/write\")\n \"nvvswc.exe\" allocated 00000088 bytes of memory in \"nwtray.exe\" (Protection: \"read/write\")\n \"nwtray.exe\" allocated 00001500 bytes of memory in \"RegAsm.exe\" (Protection: \"read/write\")\n \"nwtray.exe\" allocated 00000088 bytes of memory in \"RegAsm.exe\" (Protection: \"read/write\")\n \"nwtray.exe\" allocated 00499712 bytes of memory in \"RegAsm.exe\" (Protection: \"execute/read/write\")\n \"nwtray.exe\" allocated 00000088 bytes of memory in \"nvvswc.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 65536 bytes starting with PE header signature to file \"%APPDATA%\\WinRAR\\nwtray.exe\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"\" wrote 10240 bytes starting with PE header signature to file \"%APPDATA%\\WinRAR\\nvvswc.exe\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$29","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 213.183.58.47 on port 14221","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"$2a","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2b","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]}]},"activity":{"stats":{"process_count":26,"spawned_processes_count":26,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":62,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":49,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"56ffcf56aac2ed9403ae9802","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"SAPE.Heur","contacted_countries":["RUS","USA"],"submit_name":"HITMAN.exe","analysis_start_time":"2016-04-02T08:55:50+00:00","indicators_count":{"informative":12,"suspicious":22,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"213.183.58.47","port":14221,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"address":"213.183.58.47","port":0,"protocol":"UNKNOWN","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"address":"66.150.188.176","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]}],"dns_resolutions":[{"domain":"files.catbox.moe","address":"66.150.188.176","country":"United States","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"domain":"latehost.net","address":"213.183.58.47","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]}],"http_requests":[{"host":"files.catbox.moe","host_ip":"66.150.188.176:80","url":"/do3aqb.gifv","method":"GET","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}],"processes":[{"pid":2628,"ppid":0,"name":"HITMAN.exe","command_line":"","normalized_path":"Z:\\HITMAN.exe","uid":"00116453-00002628","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAADQSURBVFhH7ZYxDoAwCEV7GG/pbLyQh/AAbo6ewcRNUweDCOVjYl0wcTCV8vpKSVOb0v7nm/5MnnMHQBgIA7CBnT3LNF39g4+VvvmxhwCGvn/MWRVAWlE1AE0nBSh1Ux7v2gIanAPpgwBYyYutmAZv63oWnAdgHsfb/5olsQg1cg8AsnrRQNc0KjkKgCYXAfi+U3XVAdAGo0HmeOu+8agBNKlmyqPf3AIURjOQT4LbANpUpD7gXb37SmYVYQB8bsAqqDfj0H3gzcRoTACEgTBwABha2IqoG/aaAAAAAElFTkSuQmCC"},{"pid":3780,"ppid":0,"name":"nvvswc.exe","command_line":"","normalized_path":"%APPDATA%\\WinRAR\\nvvswc.exe","uid":"00161125-00003780"},{"pid":4068,"ppid":0,"name":"cmd.exe","command_line":"/c reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00178234-00004068"},{"pid":3640,"ppid":0,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\system32\\reg.exe","uid":"00179781-00003640"},{"pid":3840,"ppid":0,"name":"nwtray.exe","command_line":"","normalized_path":"%APPDATA%\\WinRAR\\nwtray.exe","uid":"00180343-00003840"},{"pid":2920,"ppid":0,"name":"nvvswc.exe","command_line":"","normalized_path":"%APPDATA%\\WinRAR\\nvvswc.exe","uid":"00228125-00002920"},{"pid":3172,"ppid":0,"name":"cmd.exe","command_line":"/c reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00252687-00003172"},{"pid":3104,"ppid":0,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\system32\\reg.exe","uid":"00254546-00003104"},{"pid":3372,"ppid":0,"name":"cmd.exe","command_line":"/c reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00258234-00003372"},{"pid":3184,"ppid":0,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\system32\\reg.exe","uid":"00259531-00003184"},{"pid":1668,"ppid":0,"name":"cmd.exe","command_line":"/c reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00266000-00001668"},{"pid":1604,"ppid":0,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\system32\\reg.exe","uid":"00267265-00001604"},{"pid":2120,"ppid":0,"name":"cmd.exe","command_line":"/c reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00270859-00002120"},{"pid":2072,"ppid":0,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\system32\\reg.exe","uid":"00272000-00002072"},{"pid":2556,"ppid":0,"name":"cmd.exe","command_line":"/c reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00275187-00002556"},{"pid":2168,"ppid":0,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\system32\\reg.exe","uid":"00276312-00002168"},{"pid":1392,"ppid":0,"name":"cmd.exe","command_line":"/c reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00280109-00001392"},{"pid":1080,"ppid":0,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\system32\\reg.exe","uid":"00281265-00001080"},{"pid":2256,"ppid":0,"name":"cmd.exe","command_line":"/c reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00285015-00002256"},{"pid":356,"ppid":0,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\system32\\reg.exe","uid":"00286203-00000356"},{"pid":2064,"ppid":0,"name":"cmd.exe","command_line":"/c reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00289593-00002064"},{"pid":1232,"ppid":0,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\system32\\reg.exe","uid":"00290703-00001232"},{"pid":3632,"ppid":0,"name":"cmd.exe","command_line":"/c reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00183515-00003632"},{"pid":3008,"ppid":0,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\system32\\reg.exe","uid":"00184828-00003008"},{"pid":3560,"ppid":0,"name":"cmd.exe","command_line":"/c reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00188265-00003560"},{"pid":3212,"ppid":0,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" /v \"Load\" /d \"%APPDATA%\\WinRAR\\nvvswc.exe\" /f","normalized_path":"%WINDIR%\\system32\\reg.exe","uid":"00189562-00003212"}],"all_imported_dlls":["urlmon.dll","ntlanman.dll","ntdll.dll","culture.dll","bcrypt.dll","comctl32.dll","shdocvw.dll","profapi.dll","msvcrt.dll","MSCOREE.DLL","mscorjit.dll","WindowsCodecs.dll","CLBCatQ.DLL","MPR.dll","MSCTF.dll","VERSION.dll","System.ni.dll","PROPSYS.dll","DEVOBJ.dll","LPK.dll","rsaenh.dll","ole32.dll","ADVAPI32.dll","Microsoft.VisualBasic.ni.dll","cscapi.dll","SETUPAPI.dll","KERNELBASE.dll","System.Xml.ni.dll","wkscli.dll","sechost.dll","RPCRT4.dll","WINBRAND.dll","SspiCli.dll","USP10.dll","PSAPI.DLL","davclnt.dll","CFGMGR32.dll","mscoreei.dll","shfolder.dll","ieframe.dll","IMM32.DLL","System.Configuration.ni.dll","kernel32.dll","CRYPTBASE.dll","CRYPTSP.dll","System.Drawing.ni.dll","uxtheme.dll","netutils.dll","NSI.dll","OLEAUT32.dll","mscorwks.dll","ntmarta.dll","USER32.dll","KERNEL32.dll","GDI32.dll","drprov.dll","WS2_32.dll","SHLWAPI.dll","shell32.dll","gdiplus.dll","apphelp.dll","mscorlib.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"nvvswc.exe","sha256":"5a7b1b78c126562ff68c3fb3ee65a1c1954e8534445c4063aee0bae0e1c6d0e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"name":"nwtray.exe","sha256":"b52dfce5f89a429888f35bf530eb9efc6d24431f606f1a98795ee13f2c9b1c79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%SAMPLEDIR%\\HITMAN.exe.config","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index137.dat","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\assembly\\pubpol15.dat","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%APPDATA%\\WinRAR","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%SAMPLEDIR%\\HITMAN.exe","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%APPDATA%\\WinRAR\\nwtray.exe","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%APPDATA%\\WinRAR\\nvvswc.exe","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%APPDATA%\\WinRAR\\nvvswc.exe.config","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"%APPDATA%\\WinRAR\\nwtray.exe.config","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ffcf56aac2ed9403ae9802"}]}]}},"report_ids":{"sandbox_job_ids":["56ffcf56aac2ed9403ae9802"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious IL:Trojan.MSILZilla Sample b52dfce5f89a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b52dfce5f89a…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/28 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b52dfce5f89a429888f35bf530eb9efc6d24431f606f1a98795ee13f2c9b1c79"}],["$","meta","4",{"property":"og:title","content":"Malicious IL:Trojan.MSILZilla Sample b52dfce5f89a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b52dfce5f89a…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/28 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b52dfce5f89a429888f35bf530eb9efc6d24431f606f1a98795ee13f2c9b1c79"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious IL:Trojan.MSILZilla Sample b52dfce5f89a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b52dfce5f89a…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/28 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]