26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MultiInjector.dd Sample b834f96b09a0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b834f96b09a0…. Malware family: Trojan.MultiInjector.dd. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22","keywords":["Malicious","Trojan.MultiInjector.dd","malware analysis","sandbox report","threat intelligence","b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22"],"about":{"@type":"SoftwareApplication","name":"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin","applicationCategory":["peexe","executable"],"identifier":"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MultiInjector.dd","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T53b,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteByte" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Microsoft.Deployment.Compression.dll"28:T4ea,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000824.00000000.135749.00BD9000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000824.00000000.135749.00BD9000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000824.00000000.135749.00BD9000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000824.00000000.135749.00BD9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000824.00000000.135749.00BD9000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000824.00000000.135749.00BD9000.00000002.mdmp")29:T93b,Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "ComputeHMACSHA256Hash" (Indicator: "HMAC"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "ComputeHMACSHA256Hash" (Indicator: "HMACSHA256"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "DeriveBytesIterations" (Indicator: "DeriveBytes"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to ", HashAlgorithmName =" (Indicator: "HashAlgorithm"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "SHA384" (Indicator: "SHA384"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to "SHA512" (Indicator: "SHA512"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin")2a:T659,"b__2_0" (Indicator: "LoadResource"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "b__3_0" (Indicator: "LoadResource"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "b__1" (Indicator: "LoadResource"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "LoadResourcePack" (Indicator: "LoadResource"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "LoadResourcesFromStream" (Indicator: "LoadResource"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "LoadResourcePacks" (Indicator: "LoadResource"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "WindowsNative.SizeofResource(handle, resourceInformationBlockPtr)" (Indicator: "SizeofResource"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "WindowsNative.LockResource(dataHandle)" (Indicator: "LockResource"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin")34:T5a7,Process __ConvertFromBase64StringFlexible" (Indicator: "base64"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "<1>__ConvertFromBase64StringFlexible" (Indicator: "FromBase64String"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "ZipFile" (Indicator: "zipfile"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "ParseBase32String" (Indicator: "base32"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "base32String" (Indicator: "base32"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "FromBase64String" (Indicator: "base64"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "<0>__ToBase64String" (Indicator: "base64"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "<0>__ToBase64String" (Indicator: "ToBase64String"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "base64String" (Indicator: "base64"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "ConvertToBase64UrlString" (Indicator: "base64"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "RNGCryptoServiceProvider" (Indicator: "rngcryptoserviceprovider"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000824.00000000.135749.033C0000.00000004.mdmp") Found string "SA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000824.00000000.135749.033C0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000824.00000000.135749.033C0000.00000004.mdmp")46:T5fb,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "GetCurrentProcessMainModuleFileName" (Indicator: "GetCurrentProcess"; File: "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000824.00000000.135749.00BD9000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000824.00000000.135749.00BD9000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000824.00000000.135749.00BD9000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000824.00000000.135749.00BD9000.00000002.mdmp")47:T449,"__ConvertFromBase64StringFlexible\" (Indicator: \"FromBase64String\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"EncryptRSA\" (Indicator: \"EncryptRSA\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002632-00000C2B-1106452059\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000824.00000000.135749.00BD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"Microsoft.Deployment.WindowsInstaller.Package.dll\"\n Observed dotnet function \"GetFiles\" in \"Microsoft.Deployment.Compression.dll\"\n Observed dotnet function \"GetDirectories\" in \"Microsoft.Deployment.Compression.dll\"\n Observed dotnet function \"GetDirectories\" in \"ScreenConnect.InstallerActions.dll\"\n Observed dotnet function \"GetFileSystemEntries\" in \"ScreenConnect.InstallerActions.dll\"\n Observed dotnet function \"GetFiles\" in \"ScreenConnect.InstallerActions.dll\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002632-00000C2B-1106452059\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000824.00000000.135749.00BD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000824.00000000.135749.00BD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WindowsNative.WTSEnumerateSessions(IntPtr.Zero, 0, 1, &sessionInfos, &count)\" (Indicator: \"WTSEnumerateSessions\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002632-00000C2B-1098994989\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002632-00000C2B-1098995516\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\"\n Found system information discovery API: \"WindowsNative.GetMonitorInfo(monitorHandle, ref monitorInfo)\" in file \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00000824.00000000.135749.00BD9000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00000824.00000000.135749.00BD9000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"CommandSendMessage\" (Indicator: \"sendmessage\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00002632-00000C2B-1106414945\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00002632-00000C2B-1106414979\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000824.00000000.135749.033C0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000824.00000000.135749.033C0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000824.00000000.135749.033C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000824.00000000.135749.00BD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00000824.00000000.135749.033C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000824.00000000.135749.00BD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"Microsoft.Deployment.WindowsInstaller.Package.dll\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"Microsoft.Deployment.WindowsInstaller.Package.dll\"\n Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"Microsoft.Deployment.Compression.dll\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"Microsoft.Deployment.Compression.dll\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"Microsoft.Deployment.Compression.dll\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000824.00000000.135749.00BD9000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000824.00000000.135749.00BD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SYSTEM\\CurrentControlSet\\Services\\\" in Source: b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\n \"SOFTWARE\\Microsoft\\Cryptography\" in Source: b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\" in Source: b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\n \"uSoftware\\Policies\\Microsoft\\Windows\\Installer\" in Source: b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$34","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$35","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$37","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"FCICreate\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIAddFile\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIFlushCabinet\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIFlushFolder\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIDestroy\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDICreate\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDICopy\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDIDestroy\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDIIsCabinet\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"DosDateTimeToFileTime\" in \"Microsoft.Deployment.Compression.dll\"\n Observed unmanaged function \"FileTimeToDosDateTime\" in \"Microsoft.Deployment.Compression.dll\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\Pipe\\TerminalServer\\SystemExecSrvr\\\n Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"k__BackingField\" (Indicator: \"nthash\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found string \"k__BackingField\" (Indicator: \"nthash\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found string \"get_ScreenshotContentHash\" (Indicator: \"nthash\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found string \"set_ScreenshotContentHash\" (Indicator: \"nthash\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found string \"get_CurrentScreenshotContentHash\" (Indicator: \"nthash\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")\n Found string \"set_CurrentScreenshotContentHash\" (Indicator: \"nthash\"; File: \"b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22.bin]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000824.00000000.135749.00BD9000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00000824.00000000.135749.00BD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" Microsoft Corporation\"\n \"ScreenConnect.Windows.dll\" was detected as \"Morphine v1.2 (DLL)\"\n \"Microsoft.Deployment.WindowsInstaller.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"\n \"Microsoft.Deployment.WindowsInstaller.Package.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"\n \"Microsoft.Deployment.Compression.Cab.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"\n \"Microsoft.Deployment.Compression.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"\n \"ScreenConnect.InstallerActions.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a33d14b43afb03b520acb91"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"