26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T506,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample b9f2ba742e2e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b9f2ba742e2e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 13/27 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b9f2ba742e2e227a55912746acf22992d2dfc416d3877665b83abf0bc3e3f093","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","b9f2ba742e2e227a55912746acf22992d2dfc416d3877665b83abf0bc3e3f093"],"about":{"@type":"SoftwareApplication","name":"b9f2ba742e2e227a55912746acf22992d2dfc416d3877665b83abf0bc3e3f093.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"b9f2ba742e2e227a55912746acf22992d2dfc416d3877665b83abf0bc3e3f093","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T558,"Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1834745856', 'hResInfo': '1836229728'}" (UID: 00000000-00004924) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1834745856', 'hResInfo': '1836229744'}" (UID: 00000000-00004924) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1834745856', 'hResInfo': '1836229760'}" (UID: 00000000-00004924) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1834745856', 'hResInfo': '1836229776'}" (UID: 00000000-00004924) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1834745856', 'hResInfo': '1836229968'}" (UID: 00000000-00004924) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1834745856', 'hResInfo': '1836229856'}" (UID: 00000000-00004924) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1834745856', 'hResInfo': '1836229904'}" (UID: 00000000-00004924) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1834745856', 'hResInfo': '1836229920'}" (UID: 00000000-00004924) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1834745856', 'hResInfo': '1836229936'}" (UID: 00000000-00004924) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1834745856', 'hResInfo': '1836229952'}" (UID: 00000000-00004924)28:T86f,"svchost.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\OLEAUT") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\WBEMSCRIPTING.SWBEMLOCATOR") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\WBEMSCRIPTING.SWBEMLOCATOR\CLSID") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR\CLSID") "svchost.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR\CLSID") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR\CLSID") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PROGIDINDEX") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER32") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER32") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER")29:T9ff,"" (Indicator: "enumchildwindows"; Source: "00000000-00004924.00000000.249701.02F10000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005136.00000000.249942.03400000.00000004.mdmp, 00000000-00005136.00000001.251863.03400000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00006460.00000000.249705.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007008.00000000.253793.00680000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00008056.00000000.249699.03E00000.00000004.mdmp, 00000000-00008056.00000002.251825.03E00000.00000004.mdmp")2c:T22b6,"" (Indicator: "GetDC"; Source: "00000000-00004924.00000000.249701.02F10000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004924.00000000.249701.02F10000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004924.00000000.249701.02F10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004924.00000000.249701.02F10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004924.00000000.249701.02F10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004924.00000000.249701.02F10000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004924.00000000.249701.02F10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004924.00000000.249701.02F10000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005136.00000000.249942.03400000.00000004.mdmp, 00000000-00005136.00000001.251863.03400000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005136.00000000.249942.03400000.00000004.mdmp, 00000000-00005136.00000001.251863.03400000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005136.00000000.249942.03400000.00000004.mdmp, 00000000-00005136.00000001.251863.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005136.00000000.249942.03400000.00000004.mdmp, 00000000-00005136.00000001.251863.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005136.00000000.249942.03400000.00000004.mdmp, 00000000-00005136.00000001.251863.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005136.00000000.249942.03400000.00000004.mdmp, 00000000-00005136.00000001.251863.03400000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005136.00000000.249942.03400000.00000004.mdmp, 00000000-00005136.00000001.251863.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005136.00000000.249942.03400000.00000004.mdmp, 00000000-00005136.00000001.251863.03400000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006460.00000000.249705.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006460.00000000.249705.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006460.00000000.249705.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006460.00000000.249705.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006460.00000000.249705.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006460.00000000.249705.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006460.00000000.249705.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006460.00000000.249705.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007008.00000000.253793.00680000.00000004.mdmp")41:T8c5,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004924.00000000.249701.02F10000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005136.00000000.249942.03400000.00000004.mdmp, 00000000-00005136.00000001.251863.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006460.00000000.249705.032B0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007008.00000000.253793.00680000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008056.00000000.249699.03E00000.00000004.mdmp, 00000000-00008056.00000002.251825.03E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006448-00000BC0-2889941731\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00005136.00000000.249942.03465000.00000004.mdmp\n 00000000-00005136.00000001.251863.03465000.00000004.mdmp\n Observed string: \"amsiscanbuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00005136.00000000.249942.03465000.00000004.mdmp\n Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00008056.00000000.249699.03E12000.00000004.mdmp\n Observed string: \"amsiscanbuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00008056.00000000.249699.03E12000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"svchost.exe has big resource with name: \"svchost.svchost.exe\" size: \"733696\" and abnormal entropy:\"7.819637875362864\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006460.00000000.249705.00D32000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY1; Source: \"00000000-00004924.00000002.253541.07AD0000.00000004.mdmp, 00000000-00004924.00000002.253541.08EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"b9f2ba742e2e227a55912746acf22992d2dfc416d3877665b83abf0bc3e3f093.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007008.00000000.253793.00680000.00000004.mdmp\")\n Found api reference \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; Source: \"00000000-00008056.00000000.249699.03E12000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00008056.00000000.249699.03E12000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007008.00000000.253793.00680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.98302","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"clang version 21.1.8 (https://github.com/llvm/llvm-project.git 2078da43e25a4623cab2d0d60decddf709aaea28)\" (Indicator: \"github.com\"; Source: \"00000000-00006460.00000000.249705.00D32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004924-00000C2B-2895651107\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameA\" (Source: \"00000000-00008056.00000000.249699.03E12000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004924-00000C2B-2895651107\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008056-00000C2B-2894009867\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00008056.00000000.249699.03E12000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00004924-00000C2B-2897776953\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004924-00000C2B-2898003308\")\n Found reference to API \"WTSFreeMemoryW\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004924-00000C2B-2898003341\")\n Found reference to API \"WTSOpenServerW\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00008056.00000000.249699.03E12000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006448-00000C2B-2889752476\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006448-00000C2B-2889752955\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008056-00000C2B-2897898648\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"EnumDateFormatsW\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00008056.00000000.249699.03E12000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00008056-00000C2B-2898895810\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"154843311466,7552,114,,GetMonitorInfoA,user32.dll,\"01:06:01.437\",RX=0,PX=0\" in \"00000000-00004924.00000002.253541.08EA0000.00000004.mdmp\"\n Found system information discovery API: \"154967658599,7552,114,,GetMonitorInfoA,user32.dll,\"01:06:01.484\",RX=0,PX=0\" in \"00000000-00004924.00000002.253541.08EA0000.00000004.mdmp\"\n Found system information discovery API: \"154967854799,7552,114,,GetMonitorInfoA,user32.dll,\"01:06:01.484\",RX=0,PX=0\" in \"00000000-00004924.00000002.253541.08EA0000.00000004.mdmp\"\n Found system information discovery API: \"154917896443,7552,114,,GetMonitorInfoA,user32.dll,\"01:06:01.468\",RX=0,PX=0\" in \"00000000-00004924.00000002.253541.08EA0000.00000004.mdmp\"\n Found system information discovery API: \"154967740119,7552,114,,GetMonitorInfoA,user32.dll,\"01:06:01.484\",RX=0,PX=0\" in \"00000000-00004924.00000002.253541.08EA0000.00000004.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00008056.00000000.249699.06900000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"setupdigetdeviceregistrypropertyw\" (Indicator: \"setupdigetdeviceregistryproperty\"; Source: \"00000000-00005136.00000000.249942.03465000.00000004.mdmp, 00000000-00005136.00000001.251863.03465000.00000004.mdmp\")\n Found reference to API \"setupdigetdeviceregistrypropertya\" (Indicator: \"setupdigetdeviceregistryproperty\"; Source: \"00000000-00005136.00000000.249942.03465000.00000004.mdmp, 00000000-00005136.00000001.251863.03465000.00000004.mdmp\")\n Found reference to API \"setupdigetdeviceregistrypropertya\" (Indicator: \"setupdigetdeviceregistryproperty\"; Source: \"00000000-00008056.00000000.249699.03E12000.00000004.mdmp\")\n Found reference to API \"setupdigetdeviceregistrypropertyw\" (Indicator: \"setupdigetdeviceregistryproperty\"; Source: \"00000000-00008056.00000000.249699.03E12000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" www.upx.sourceforge.net\"\n \"svchost.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"Zapret2.0Bypass.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a3694a0057bbd37db008d98"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"