26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 53:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ab,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILheracles.Generic Sample be9a6afa4829… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample be9a6afa4829…. Malware family: MSILheracles.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d","keywords":["Malicious","MSILheracles.Generic","malware analysis","sandbox report","threat intelligence","be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d"],"about":{"@type":"SoftwareApplication","name":"tmplbmxlbsw","applicationCategory":["peexe","assembly","executable"],"identifier":"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILheracles.Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T40a,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp, 00000000-00007884.00000001.119714.6FDD1000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp")28:T66e,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp, 00000000-00007884.00000001.119714.6FDE5000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp, 00000000-00007884.00000001.119714.6FDE5000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp")29:T564,Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin") Found reference to ";RC2t" (Indicator: "RC2"; Source: "00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00007884.00000002.120426.00FF2000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007884.00000002.120426.00FF2000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00007884.00000002.120426.0AD40000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00007884.00000002.120426.0AD40000.00000004.mdmp") Found reference to "M_publicKeyOid" (Indicator: "Oid"; Source: "00000000-00007884.00000002.120426.0AD40000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00007884.00000002.120426.0AD40000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00007884.00000002.120426.0AD40000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00007884.00000002.120426.0AD40000.00000004.mdmp")2a:T1251," nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe "" (Indicator: ""cmd" /c ping 127.0.0.1 -n 17 > nul && reg add "hkcu\software\microsoft\windows nt\currentversion\winlogon" /f /v "shell" /t reg_sz /d "explorer.exe,%appdata%\microsoft\windows\start menu\programs\startup\skype\skype.exe,"") in Source: cmd.exe ""cmd" /c ping 127.0.0.1 -n 16 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe "" (Indicator: ""cmd" /c ping 127.0.0.1 -n 16 > nul && reg add "hkcu\software\microsoft\windows nt\currentversion\winlogon" /f /v "shell" /t reg_sz /d "explorer.exe,%appdata%\microsoft\windows\start menu\programs\startup\skype\skype.exe,"") in Source: cmd.exe ""cmd" /c ping 127.0.0.1 -n 25 > nul && copy "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe" && ping 127.0.0.1 -n 25 > nul && "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"" (Indicator: ""cmd" /c ping 127.0.0.1 -n 25 > nul && copy "%appdata%\microsoft\windows\start menu\programs\startup\skype\skype.exe" && ping 127.0.0.1 -n 25 > nul && "%appdata%\microsoft\windows\start menu\programs\startup\skype\skype.exe"") in Source: cmd.exe ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007884.00000002.120426.03540000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007884.00000002.120426.03540000.00000004.mdmp35:Ta78,""cmd" /c ping 127.0.0.1 -n 17 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_" in Source: 00000000-00002032-00000C46-85262246898 ""cmd" /c ping 127.0.0.1 -n 16 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_" in Source: 00000000-00007884-00000C46-86978898036 ""cmd" /c ping 127.0.0.1 -n 17 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe "" in Source: cmd.exe ""cmd" /c ping 127.0.0.1 -n 16 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe "" in Source: cmd.exe "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007884.00000001.119714.03540000.00000004.mdmp 00000000-00007884.00000002.120426.03540000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007884.00000001.119714.03540000.00000004.mdmp 00000000-00007884.00000002.120426.03540000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp "HKLM\" in Source: 00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007884.00000002.120426.03540000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007884.00000002.120426.03540000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E60687F7-01A1-40AA-86A" in Source: 00000000-00007884.00000002.120426.035DE000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007884.00000002.120426.035DE000.00000004.mdmp "HKCU\" in Source: 00000000-00007884.00000002.120426.0AD40000.00000004.mdmp36:T8e5,Process nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_" (Indicator: "ping 127"; Source: "00000000-00002032-00000C46-85262246898") Found string ""cmd" /c ping 127.0.0.1 -n 16 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_" (Indicator: "ping 127"; Source: "00000000-00007884-00000C46-86978898036") Found string ""cmd" /c ping 127.0.0.1 -n 25 > nul && copy "%APPDATA%\Mic" (Indicator: "ping 127"; Source: "00000000-00007884-00000C46-110015090663"), Found string ""cmd" /c ping 127.0.0.1 -n 17 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe,"" (Indicator: "ping 127"; File: "cmd.exe"), Found string ""cmd" /c ping 127.0.0.1 -n 16 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe,"" (Indicator: "ping 127"; File: "cmd.exe"), Found string ""cmd" /c ping 127.0.0.1 -n 25 > nul && copy "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe" && ping 127.0.0.1 -n 25 > nul && "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"" (Indicator: "ping 127"; File: "cmd.exe"), Found string "c ping 127.0.0.1 -n" (Indicator: "ping 127"; Source: "00000000-00007884.00000002.120426.0AD40000.00000004.mdmp")42:T73b,Found string ""cmd" /c ping 127.0.0.1 -n 17 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_" (Indicator: "/c ping"; Source: "00000000-00002032-00000C46-85262246898") Found string "/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "" (Indicator: "/c ping"; File: "AMSI"), Found string "ping 127.0.0.1 -n 17" (Indicator: "ping "; Source: "00000000-00004312-00000C46-2358957444"), Found string ""cmd" /c ping 127.0.0.1 -n 16 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_" (Indicator: "/c ping"; Source: "00000000-00007884-00000C46-86978898036"), Found string ""cmd" /c ping 127.0.0.1 -n 25 > nul && copy "%APPDATA%\Mic" (Indicator: "/c ping"; Source: "00000000-00007884-00000C46-110015090663") Found string "ping 127.0.0.1 -n 16" (Indicator: "ping "; Source: "00000000-00007356-00000C46-1331200446") Found string "ping 127.0.0.1 -n 25" (Indicator: "ping "; Source: "00000000-00005100-00000C46-1264944674") Found string ""cmd" /c ping 127.0.0.1 -n 17 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe "" (Indicator: "/c ping"; File: "cmd.exe") Found string ""cmd" /c ping 127.0.0.1 -n 16 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe "" (Indicator: "/c ping"; File: "cmd.exe") Found string ""cmd" /c ping 127.0.0.1 -n 25 > nul && copy "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe" && ping 127.0.0.1 -n 25 > nul && "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"" (Indicator: "/c ping"; File: "cmd.exe")43:T43c,Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference ".ctor" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Credentials" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_EnableSsl" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference ".ctor" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Subject" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Body" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "Send" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin"44:T514,"5.8.10.13" "1.0.0.0" Potential IP "1.1.1.1" found in string "/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "", "2.0.3.5", "3.0.1.2", Potential IP "127.0.0.1" found in string "ping 127.0.0.1 -n 17", Potential IP "127.0.0.1" found in string ""cmd" /c ping 127.0.0.1 -n 25 > nul && copy "%APPDATA%\Mic" Potential IP "127.0.0.1" found in string "ping 127.0.0.1 -n 16" Potential IP "127.0.0.1" found in string "ping 127.0.0.1 -n 25" Potential IPs "127.0.0.1" "127.0.0.1" found in string ""cmd" /c ping 127.0.0.1 -n 25 > nul && copy "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe" && ping 127.0.0.1 -n 25 > nul && "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"" Potential IP "10.0.0.0" found in string "icrosoft.VisualBasic,10.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "ystem.Drawing,4.0.0.0,,b03f5f7f11d50a3a" "0.0.0.0" "11.0.0.0" "17.0.0.0" Potential IP "17.12.0.0" found in string "KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 17.12.0.0" Potential IP "4.0.0.0" found in string ",4.0.0.0,,b03f5f7f11d50a3a" "192.168.0.2" Potential IP "1.1.1.1" found in string "C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "", "127.0.0.1", Potential IP "127.0.0.1" found in string "c ping 127.0.0.1 -n"45:T447,Heuristic match: "usiv.tf" Heuristic match: "pyrc.yt" Heuristic match: "txet.me" Heuristic match: "dniw.me" Heuristic match: "gami.gn" Heuristic match: "ward.me" Heuristic match: "lloc.me" Heuristic match: "+2?w.wf" Heuristic match: "[?.nf" Pattern match: "microsoft.net/framework/v4.0.30319/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "&n.us" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "falimotin.my" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0"46:Tcbb,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007884.00000000.117794.03540000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007884.00000001.119714.03540000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportfterddelayer\qu:\programdata\microsoft\windows" - Source: "00000000-00007884.00000001.119714.03C60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007884.00000001.119714.6FDD1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007884.00000002.120426.03540000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportfterddelayer\qu:\programdata\microsoft\windows" - Source: "00000000-00007884.00000002.120426.03C60000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json05/20" - Source: "00000000-00007884.00000002.120426.0B1E0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,005/20" - Source: "00000000-00007884.00000002.120426.0B1E0000.00000002.mdmp")47:T8f3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007884.00000000.117794.03540000.00000004.mdmp, 00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007884.00000000.117794.03540000.00000004.mdmp, 00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007884.00000000.117794.03540000.00000004.mdmp, 00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007884.00000000.117794.03540000.00000004.mdmp, 00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007884.00000000.117794.03540000.00000004.mdmp, 00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007884.00000000.117794.03540000.00000004.mdmp, 00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007884.00000000.117794.03540000.00000004.mdmp, 00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007884.00000000.117794.03540000.00000004.mdmp, 00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp")48:T64f,Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference "Open" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteNonQuery" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteReader" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed namespace "System.Data.SqlClient.SqlDataReader" and TypeReference "get_Item" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed namespace "System.Data.SqlClient.SqlDataReader" and TypeReference "Read" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteScalar" in "be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin"49:T9e4," Nul & Del "" (Indicator: "ping"; File: "AMSI"), Found string ""cmd" /c ping 127.0.0.1 -n 17 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe,"" (Indicator: "ping"; File: "cmd.exe"), Found string ""cmd" /c ping 127.0.0.1 -n 16 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe,"" (Indicator: "ping"; File: "cmd.exe"), Found string ""cmd" /c ping 127.0.0.1 -n 25 > nul && copy "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe" && ping 127.0.0.1 -n 25 > nul && "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"" (Indicator: "ping"; File: "cmd.exe"), Found string "C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "" (Indicator: "ping"; Source: "00000000-00007884.00000002.120426.0AD40000.00000004.mdmp") Found string "c ping 127.0.0.1 -n" (Indicator: "ping"; Source: "00000000-00007884.00000002.120426.0AD40000.00000004.mdmp")4d:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00007884.00000001.119714.6FD81000.00000002.mdmp")4e:T56d," nul && REG ADD "HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe "" (UID: 00000000-00004312) Spawned process "skype.exe" (UID: 00000000-00007884) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 17" (UID: 00000000-00006264) Spawned process "cmd.exe" with commandline ""cmd" /c ping 127.0.0.1 -n 16 > nul && REG ADD "HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe "" (UID: 00000000-00007356) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 16" (UID: 00000000-00005952) Spawned process "cmd.exe" with commandline ""cmd" /c ping 127.0.0.1 -n 25 > nul && copy "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe" && ping 127.0.0.1 -n 25 > nul && "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe"" (UID: 00000000-00005100) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 25" (UID: 00000000-00007204)52:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAACAAAAAAAAAAAAAAAAAAAAPgAAAAAAAAAAAAAAAAAAAD3iIiIiIiIiIiIh2AAAAAA+Ij///////////+AAAAAAPiI////iIiIiIiPgAAAAAD4iP////+IiIiIj4AAAAAA+Ij/////+IiIiI+AD/AAAPiI/////4d3d3d4gA//AAD4iP///4d3iIiHd3AP/wAA+Ij///h3j////4dwD/AAAPiI//+HeI/4iIiIdAD/AAD4iP//d4dGj4iIiIdgfwAA+Ij/+Hj2BAf4iIiIcPcAAPiI//eIiHBEj4iIiHT4AAD4iP+HiI/3BH+IiIiHCAAA+Ij/h4iIj2RI+IiIhwgAAPiI/4eI//+ARGR/iIcPAAD4iP93iP//9kRAf4iHD2AA+Ij/h4////dGZ3+Ihw9gAPj4/4eI///4Zn/4iIcIYAD4+P/3eP///3Znj4h2b0AA+Pj/+HiP//+EZmeIcG9AAP////93iP//+GZGh2//QAD4////h3iI//+Hd3Zn/wAA//////h3iIiIiIdgf/8AAPj/////h3d4h3dngG//AAD///////+Hd3d3j4AP/wAA+P////////////+AQAAAAP//////////////gAAAAAD//////////////4AAAAAA+Ij///////////+IcAAAAPiIiIiIiIiIiIiIf/AAD///////////wAAD/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAA/8AAAH/AAAB/wAAAf8AAAH/AAAA/wAAAP8AAAH/AAAB/wAAAf8AAAH/AAAD/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAA//gAAfw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790867637157,"unified_at":"2026-10-01T15:13:57.157Z","metadata":{"hashes":{"sha256":"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d","sha1":"92f978b4747f9d5d159640b5a3bdaa17c2e880d4","md5":"94f37a8102d932fe3cd42aba6dd42a05","sha512":"1bab0ec4488a22448d85ae96b715547bb72d9de195ec8ce0226682d679f288cc4014f94a593a8bfa58667d0510cc283246e2be130e2cc282663ae1bc1d3a0512","ssdeep":"12288:tl8SwYmvIb18ZRlhdIu/bQHg0jpPDbFswDp:yfZRlhl/UVNFB","ssdeep_chunks":["12288:tl8SwYm","12288:l8SwYmv","12288:8SwYmvI","12288:SwYmvIb","12288:wYmvIb1","12288:YmvIb18","12288:mvIb18Z","12288:vIb18ZR","12288:Ib18ZRl","12288:b18ZRlh","12288:18ZRlhd","12288:8ZRlhdI","12288:ZRlhdIu","12288:RlhdIu/","12288:lhdIu/b","12288:hdIu/bQ","12288:dIu/bQH","12288:Iu/bQHg","12288:u/bQHg0","12288:/bQHg0j","12288:bQHg0jp","12288:QHg0jpP","12288:Hg0jpPD","12288:g0jpPDb","12288:0jpPDbF","12288:jpPDbFs","12288:pPDbFsw","12288:PDbFswD","12288:DbFswDp","24576:tl8SwYm","24576:l8SwYmv","24576:8SwYmvI","24576:SwYmvIb","24576:wYmvIb1","24576:YmvIb18","24576:mvIb18Z","24576:vIb18ZR","24576:Ib18ZRl","24576:b18ZRlh","24576:18ZRlhd","24576:8ZRlhdI","24576:ZRlhdIu","24576:RlhdIu/","24576:lhdIu/b","24576:hdIu/bQ","24576:dIu/bQH","24576:Iu/bQHg","24576:u/bQHg0","24576:/bQHg0j","24576:bQHg0jp","24576:QHg0jpP","24576:Hg0jpPD","24576:g0jpPDb","24576:0jpPDbF","24576:jpPDbFs","24576:pPDbFsw","24576:PDbFswD","24576:DbFswDp","12288:yfZRlhl","12288:fZRlhl/","12288:ZRlhl/U","12288:Rlhl/UV","12288:lhl/UVN","12288:hl/UVNF","12288:l/UVNFB"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"tmplbmxlbsw","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":647168,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1744286321000,"last_seen":1779300891000,"last_multi_scan":1779300891000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["darktortilla","commodity","criminal","loader"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":76},"sandbox_signatures":{"informative_count":190,"suspicious_count":12,"malicious_count":10,"total":212},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Quasar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.msilheracles.220532","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.msilheracles.220532 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/GenKryptik.HECV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005bdfbc1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Suspicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Generic-L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.JQU.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenKryptik.Win32.1120162","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSILheracles.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Able to perform reflective code loading"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Delay Execution","attack_id":"T1678","attack_id_wiki":"https://attack.mitre.org/techniques/T1678","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Checks network status using ping"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Able to check internet connectivity using ping command"},{"type":"informative","value":"Contains ability to check internet connectivity"},{"type":"informative","value":"Checks internet connectivity using tracert/ping"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Tries to copy files"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Able to perform SQL operations (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Contains ability to upload data with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains ability to perform email related activity (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"ackup created with compression!\" (Source: \"00000000-00007884.00000002.120426.00FF2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"set_Position\" in \"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to perform reflective code loading","description":"Found string \"NExecuteAssembly\" (Indicator: \"executeassembly\"; Source: \"00000000-00007884.00000002.120426.0AD40000.00000004.mdmp\")\n Found string \"_nExecuteAssembly\" (Indicator: \"executeassembly\"; Source: \"00000000-00007884.00000002.120426.0AD40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":3,"id":"string-678","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007884.00000000.117794.03540000.00000004.mdmp, 00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007884.00000001.119714.03540000.00000004.mdmp\n 00000000-00007884.00000002.120426.03540000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin has big resource with name: \"resources/719293054\" size: \"244677\" and abnormal entropy:\"7.747034193234933\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007884.00000002.120426.0AD40000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007884.00000000.117794.03540000.00000004.mdmp, 00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" nul && REG ADD \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /f /v \"Shell\" /t REG_\" - (UID: 00000000-00002032)\n \" nul && REG ADD \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /f /v \"Shell\" /t REG_\" - (UID: 00000000-00007884)\n \"skype.exe\" called \"CreateProcessW\" with parameter \"\"cmd\" /c ping 127.0.0.1 -n 25 > nul && copy \"%APPDATA%\\Mic\" - (UID: 00000000-00007884), \"cmd.exe\" called \"CreateProcessW\" with parameter \"ping 127.0.0.1 -n 16\" - (UID: 00000000-00007356), \"cmd.exe\" called \"CreateProcessW\" with parameter \"ping 127.0.0.1 -n 25\" - (UID: 00000000-00005100)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\" nul && REG ADD \"HKCU\\\\Software\\ ...\" (UID: 00000000-00004312), Spawned process \"skype.exe\" (UID: 00000000-00007884), Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 17\" (UID: 00000000-00006264), Spawned process \"cmd.exe\" with commandline \"\"cmd\" /c ping 127.0.0.1 -n 16 > nul && REG ADD \"HKCU\\\\Software\\ ...\" (UID: 00000000-00007356)\n Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 16\" (UID: 00000000-00005952)\n Spawned process \"cmd.exe\" with commandline \"\"cmd\" /c ping 127.0.0.1 -n 25 > nul && copy \"%APPDATA%\\\\Microso ...\" (UID: 00000000-00005100), Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 25\" (UID: 00000000-00007204)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"\"cmd\" /c ping 127.0.0.1 -n 17 > nul && REG ADD \"HKCU\\\\Software\\ ...\" (UID: 00000000-00004312), Spawned process \"skype.exe\" (UID: 00000000-00007884), Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 17\" (UID: 00000000-00006264), Spawned process \"cmd.exe\" with commandline \"\"cmd\" /c ping 127.0.0.1 -n 16 > nul && REG ADD \"HKCU\\\\Software\\ ...\" (UID: 00000000-00007356)\n Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 16\" (UID: 00000000-00005952)\n Spawned process \"cmd.exe\" with commandline \"\"cmd\" /c ping 127.0.0.1 -n 25 > nul && copy \"%APPDATA%\\\\Microso ...\" (UID: 00000000-00005100), Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 25\" (UID: 00000000-00007204)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"General","name":"Tries to copy files","description":"Process \"cmd.exe\" with commandline \"\"cmd\" /c ping 127.0.0.1 -n 25 > nul && copy \"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\skype\\\\skype.exe\" && ping 127.0.0.1 -n 25 > nul && \"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\skype\\\\skype.exe\"\" (UID: 00000000-00005100)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-291","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"shdocvw = s 'IAttachmentExecute'\" (Source: \"00000000-00007884.00000001.119714.6FDE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp, 00000000-00007884.00000001.119714.6FDE5000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\" nul && REG ADD \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /f /v \"Shell\" /t REG_SZ /d \"explorer.exe\n%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe\n\"\" (Indicator: \"ping 127.0.0.1\"; File: \"cmd.exe\")\n Found string \"\"cmd\" /c ping 127.0.0.1 -n 16 > nul && REG ADD \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /f /v \"Shell\" /t REG_SZ /d \"explorer.exe\n%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe\n\"\" (Indicator: \"ping 127.0.0.1\"; File: \"cmd.exe\")\n Found string \"\"cmd\" /c ping 127.0.0.1 -n 25 > nul && copy \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe\" && ping 127.0.0.1 -n 25 > nul && \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe\"\" (Indicator: \"ping 127.0.0.1\"; File: \"cmd.exe\")\n Found string \"c ping 127.0.0.1 -n\" (Indicator: \"ping 127.0.0.1\"; Source: \"00000000-00007884.00000002.120426.0AD40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadString\" in \"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Headers\" in \"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform email related activity (Dotnet)","description":"$43","origin":"Static Parser","mitre_attack_id":"T1071.003","relevance":1,"id":"static-160","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin\"\n Observed namespace \"System.Net.Mail\" in \"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload data with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadString\" in \"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin\"","origin":"Static Parser","mitre_attack_id":"T1005","relevance":1,"id":"static-142","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00007884.00000001.119714.03540000.00000004.mdmp, 00000000-00007884.00000002.120426.03540000.00000004.mdmp\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; Source: \"00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00007884\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007884.00000001.119714.6FCF1000.00000020.mdmp\")\n Found string \"+ncalrpc:[OLE3951D20EDAE49D2EA5277469E91A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007884.00000002.120426.03540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007884.00000002.120426.035DE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp, 00000000-00007884.00000001.119714.6FDE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00007884.00000002.120426.00FF2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations (Dotnet)","description":"$48","origin":"Static Parser","mitre_attack_id":"T1213","relevance":10,"id":"static-175","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp\"\n Found registry query API: \"RegNotifyChangeKeyValue\" in \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00007884.00000002.120426.0AD40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"83492968557,936,3216,,LookupAccountSidW,advapi32.dll,\"00:31:10.500\",RX=0,PX=0\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007884.00000001.119714.03540000.00000004.mdmp\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00007884.00000001.119714.6FD81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" nul && REG ADD \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /f /v \"Shell\" /t REG_SZ /d \"explorer.exe,%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe,\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002032","uid":"00000000-00004312"},{"pid":6264,"ppid":4312,"name":"PING.EXE","command_line":"ping 127.0.0.1 -n 17","sha256":"c9b49dbf091bc66d6aee677269c613aeda0952ddbd113e21a6d9553c3e374d0f","normalized_path":"%WINDIR%\\SysWOW64\\PING.EXE","parent_uid":"00000000-00004312","uid":"00000000-00006264"},{"pid":7884,"ppid":2032,"name":"skype.exe","command_line":"","sha256":"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d","normalized_path":"%TEMP%\\skype.exe","parent_uid":"00000000-00002032","uid":"00000000-00007884"},{"pid":7356,"ppid":7884,"name":"cmd.exe","command_line":"\"cmd\" /c ping 127.0.0.1 -n 16 > nul && REG ADD \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /f /v \"Shell\" /t REG_SZ /d \"explorer.exe,%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe,\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00007884","uid":"00000000-00007356"},{"pid":5952,"ppid":7356,"name":"PING.EXE","command_line":"ping 127.0.0.1 -n 16","sha256":"c9b49dbf091bc66d6aee677269c613aeda0952ddbd113e21a6d9553c3e374d0f","normalized_path":"%WINDIR%\\SysWOW64\\PING.EXE","parent_uid":"00000000-00007356","uid":"00000000-00005952"},{"pid":5100,"ppid":7884,"name":"cmd.exe","command_line":"\"cmd\" /c ping 127.0.0.1 -n 25 > nul && copy \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe\" && ping 127.0.0.1 -n 25 > nul && \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\skype\\skype.exe\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00007884","uid":"00000000-00005100"},{"pid":7204,"ppid":5100,"name":"PING.EXE","command_line":"ping 127.0.0.1 -n 25","sha256":"c9b49dbf091bc66d6aee677269c613aeda0952ddbd113e21a6d9553c3e374d0f","normalized_path":"%WINDIR%\\SysWOW64\\PING.EXE","parent_uid":"00000000-00005100","uid":"00000000-00007204"}],"all_imported_dlls":["wow64win.dll","ws2_32.dll","sppc.dll","System.Configuration.ni.dll","gdi32full.dll","mscoreei.dll","windows.storage.dll","advapi32.dll","oleaut32.dll","mscorlib.ni.dll","uxtheme.dll","DWrite.dll","edputil.dll","wship6.dll","ntdll.dll","kernel32.dll","version.dll","bcrypt.dll","msctf.dll","winnsi.dll","mswsock.dll","combase.dll","imm32.dll","Accessibility.dll","ntmarta.dll","clrjit.dll","aepic.dll","wow64.dll","rpcrt4.dll","sspicli.dll","cryptsp.dll","userenv.dll","profapi.dll","slc.dll","GdiPlus.dll","ucrtbase.dll","ole32.dll","shlwapi.dll","wintrust.dll","dwmapi.dll","urlmon.dll","wshqos.dll","rP6580NT.dll","cldapi.dll","vcruntime140_clr0400.dll","ucrtbase_clr0400.dll","System.ni.dll","crypt32.dll","amsi.dll","MpClient.dll","gpapi.dll","msIso.dll","apphelp.dll","sechost.dll","msvcrt.dll","System.Core.ni.dll","comctl32.dll","clbcatq.dll","IPHLPAPI.DLL","nsi.dll","wow64cpu.dll","bcryptprimitives.dll","win32u.dll","shell32.dll","imagehlp.dll","WSHTCPIP.DLL","mscoree.dll","msvcp_win.dll","kernel.appcore.dll","clr.dll","msasn1.dll","propsys.dll","VxSSL32.dll","gdi32.dll","MpOAV.dll","psapi.dll","iertutil.dll","user32.dll","cryptbase.dll","System.Windows.Forms.dll","rsaenh.dll","cfgmgr32.dll","SHCore.dll","powrprof.dll","Windows.StateRepositoryPS.dll","KernelBase.dll","fltLib.dll","System.Drawing.dll","Microsoft.VisualBasic.dll","wldp.dll","System.Xml.ni.dll","WindowsCodecs.dll","System.Web.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"skype.exe.log","sha256":"cb0ac13e897b877b03cb3cdd02ff8d36845e1d069c97d7e33571ba0d68edb72b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin.exe.log","sha256":"cb0ac13e897b877b03cb3cdd02ff8d36845e1d069c97d7e33571ba0d68edb72b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d.bin.exe.log","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"path":"%TEMP%\\skype.exe","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\skype.exe.log","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"Local\\SM0:2032:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"Local\\SM0:2032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"SM0:2032:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"SM0:2032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2032:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2032:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7884:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7884:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7884:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"Local\\SM0:7884:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"SM0:7884:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]},{"name":"SM0:7884:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0dfa1aaacfa5f4cd01d985"}]}]}},"report_ids":{"sandbox_job_ids":["6a0dfa1aaacfa5f4cd01d985"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious MSILheracles.Generic Sample be9a6afa4829… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample be9a6afa4829…. Malware family: MSILheracles.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d"}],["$","meta","4",{"property":"og:title","content":"Malicious MSILheracles.Generic Sample be9a6afa4829… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample be9a6afa4829…. Malware family: MSILheracles.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/be9a6afa48295143f7ad35badc92bf886caa1b714689ea97ea1ec45bbea3cd6d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSILheracles.Generic Sample be9a6afa4829… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample be9a6afa4829…. Malware family: MSILheracles.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L53","11",{}]]