26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T493,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample bf05e2a7bece… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bf05e2a7bece…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996"],"about":{"@type":"SoftwareApplication","name":"bounty-13169284224960849","applicationCategory":["peexe","executable"],"identifier":"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T50b,"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin" file has an entrypoint instructions - "subesp, 0x38,pushebx,pushebp,pushesi,pushedi,calldword ptr [0x4011ac],xoresi, esi,pushesi,pushesi,pushesi,calldword ptr [0x40108c],pusheax,calldword ptr [0x4011b0],pushesi,pushesi,leaeax, [esp + 0x34],pushesi,pusheax,calldword ptr [0x4011b4],pushesi,pushesi,pushesi,pushesi,pushesi,pushesi,pushesi,pushesi,push0x80000000,movebp, 0x406d38,push0x406870,pushebp,pushesi,calldword ptr [0x40119c],calldword ptr [0x40111c],push0x4019a8,pusheax,movdword ptr [esp + 0x18], eax,call0x406414,popecx,testeax, eax," "907379812_res.tmp" file has an entrypoint instructions - "pushebp,movebp, esp,pushebx,movebx, dword ptr [ebp + 8],pushesi,movesi, dword ptr [ebp + 0xc],pushedi,movedi, dword ptr [ebp + 0x10],testesi, esi,jne0x10016716,cmpdword ptr [0x1001e56c], 0,jmp0x1001673c,cmpesi, 1,je0x10016720,cmpesi, 2,jne0x10016742,moveax, dword ptr [0x1001e574],testeax, eax,je0x10016732,pushedi,pushesi,pushebx,calleax,testeax, eax,je0x1001673e,pushedi,pushesi,pushebx,call0x1001664f,testeax, eax,jne0x10016742,xoreax, eax,jmp0x10016790,pushedi,pushesi,pushebx,call0x1000e570,cmpesi, 1,movdword ptr [ebp + 0xc], eax,jne0x1001675e,testeax, eax,jne0x1001678d,pushedi,pusheax,pushebx,call0x1001664f,"28:T584,".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\SSPICLI.DLL" ".exe" trying to access non-existent file "C:\UXTHEME.DLL" ".exe" trying to access non-existent file "C:\WINMM.DLL" ".exe" trying to access non-existent file "C:\SAMCLI.DLL" ".exe" trying to access non-existent file "C:\MSACM32.DLL" ".exe" trying to access non-existent file "C:\VERSION.DLL" ".exe" trying to access non-existent file "C:\SFC.DLL" ".exe" trying to access non-existent file "C:\SFC_OS.DLL" ".exe" trying to access non-existent file "C:\DWMAPI.DLL" ".exe" trying to access non-existent file "C:\MPR.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\USERINIT.EXE" ".exe" trying to access non-existent file "C:\userinit.exe"29:T431,".exe" trying to access non-existent file "C:\BF05E2A7BECEC76C1C9D4754A57B84D02201249D05A5D4B67D59992155587996.EXE.MANIFEST" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\907379812_RES.TMP" ".exe" trying to access non-existent file "C:\bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.exe.Manifest" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\907379812_res.tmp" "userinit.exe" trying to access non-existent file "C:\_lang.ini" "userinit.exe" trying to access non-existent file "C:\Windows\system32\userinit.exe.Local\" "userinit.exe" trying to access non-existent file "C:\Windows\_lang.ini" "userinit.exe" trying to access non-existent file "C:\Windows\System32\USERINIT.EXE.LOCAL" "userinit.exe" trying to access non-existent file "C:\Windows\_LANG.INI" "userinit.exe" trying to access non-existent file "C:\Windows\system32\syslog.dat" "userinit.exe" trying to access non-existent file "C:\Windows\System32\SYSLOG.DAT"2a:T836,".exe" called "FindFirstFileW" with parameter C:\Windows\system32\*.* (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter aaclient.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter ACCTRES.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter acledit.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter aclui.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter acppage.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter acproxy.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter ActionCenter.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter ActionCenterCPL.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter ActionQueue.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter activeds.dll (UID: 00000000-00003560) ".exe" called "FindNextFileW" with parameter activeds.tlb (UID: 00000000-00003560)2b:T61a,Observed api string:"SetSecurityDescriptorDacl which can Sets information in a discretionary access control list (DACL)"[Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin] Observed api string:"AddAccessAllowedAce which can Adds an access-allowed access control entry (ACE) to an access control list (ACL)"[Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin] Observed api string:"InitializeAcl which can Initializes a new ACL structure"[Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin] Observed api string:"GetLengthSid which can Returns the length in bytes of a valid security identifier (SID)"[Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin] Observed api string:"AllocateAndInitializeSid which can Allocates and initializes a security identifier (SID) with up to eight subauthorities"[Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin] Observed api string:"AllocateAndInitializeSid which can Initializes a security identifier (SID)"[Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin] Observed api string:"InitializeSecurityDescriptor which can Initializes a new security descriptor"[Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin] Observed api string:"FreeSid which can Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function"[Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]2c:T487,Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: 907379812_res.tmp] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 907379812_res.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 907379812_res.tmp] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 907379812_res.tmp] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 907379812_res.tmp] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 907379812_res.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 907379812_res.tmp] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 907379812_res.tmp]2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3YAAAdwAAAAAAAAAAAAB3Z3iIh3dHcAAAAAAAAAAHaPiIiIiIh0cAAAAAAAAAdPiIiIiIiIiEcAAAAAAAAHf4iHd3d3d4h3AAAAAAZmZmZmZmZmZmZmZmZmcAB3d3d3d3d3d3d3d3d3d2AAeIiIiIiIiIiIiIiIiIhgAHiIiIiIiIiIiIiIiIiIYAB4iERERERERERERERHiGAAePhMzMzIxmZmaIZmZ4hgAHj4RoxmZmZmZoqodmeIYAB4+ExszGZmZmd6qoZniGAAePhMxmxmZ4ZoOqKGZ4hgAHj4TOiIZmZmaId3hmeIYAB4+EaHiYZmZneIiGZniGAAePhGeZl4dmd3dmZmZ4hgAHj4Rod3iHd3d3d3dmeIYAB4+EZ4iHd3d3d3eHdniGAAePhIiIZmZsx4h3d3Z4hgAHj4aIiIiHbIh4h3d2eIYAB4+GiIiIiIiIiIiIh3iGAAePhoiIiIiIiIiIiId4hgAHj4aIiIiP+PiI+IiHeIYAB4+GiIiP/////4iIh3iGAAeP9nd3d3d3d3d3d3Z4hgAHj4iIiIiIiIiIiIiIiIYAB4+IiIiIiIiIiIiIiIiGAAeP/////4iIiIiIiIiIdgAHd3d3d3d3d3d3d3d3d3cAD+AAD/+AAAP/gAAD/wAAA/AAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791834989559,"unified_at":"2026-10-12T19:56:29.559Z","metadata":{"hashes":{"sha256":"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996","sha1":"77f2f287280b95819ae1a33acb586244fdacb8d4","md5":"596448c8ec02d5caec65f7f4ed2410d7","sha512":"0dc906c3bdcfdcc580869a5e487de6c3d8eecd45b2f54d6130c9da1a4cb9872c5b04b5793b180c31b995ff99f9fb787752b6a75ee3309c0c8bfbaeec487f1464","ssdeep":"3072:VJuGnYhTbK80khbOW1oWOQ1f9xHwm1PXBmXZFeA28pMGEdePl9dehiv80P80CnpZ:VJueTk1OwoWOQ3dwaWB28adeP/deUv8M","ssdeep_chunks":["3072:VJuGnYh","3072:JuGnYhT","3072:uGnYhTb","3072:GnYhTbK","3072:nYhTbK8","3072:YhTbK80","3072:hTbK80k","3072:TbK80kh","3072:bK80khb","3072:K80khbO","3072:80khbOW","3072:0khbOW1","3072:khbOW1o","3072:hbOW1oW","3072:bOW1oWO","3072:OW1oWOQ","3072:W1oWOQ1","3072:1oWOQ1f","3072:oWOQ1f9","3072:WOQ1f9x","3072:OQ1f9xH","3072:Q1f9xHw","3072:1f9xHwm","3072:f9xHwm1","3072:9xHwm1P","3072:xHwm1PX","3072:Hwm1PXB","3072:wm1PXBm","3072:m1PXBmX","3072:1PXBmXZ","3072:PXBmXZF","3072:XBmXZFe","3072:BmXZFeA","3072:mXZFeA2","3072:XZFeA28","3072:ZFeA28p","3072:FeA28pM","3072:eA28pMG","3072:A28pMGE","3072:28pMGEd","3072:8pMGEde","3072:pMGEdeP","3072:MGEdePl","3072:GEdePl9","3072:EdePl9d","3072:dePl9de","3072:ePl9deh","3072:Pl9dehi","3072:l9dehiv","3072:9dehiv8","3072:dehiv80","3072:ehiv80P","3072:hiv80P8","3072:iv80P80","3072:v80P80C","3072:80P80Cn","3072:0P80Cnp","3072:P80CnpZ","6144:VJuGnYh","6144:JuGnYhT","6144:uGnYhTb","6144:GnYhTbK","6144:nYhTbK8","6144:YhTbK80","6144:hTbK80k","6144:TbK80kh","6144:bK80khb","6144:K80khbO","6144:80khbOW","6144:0khbOW1","6144:khbOW1o","6144:hbOW1oW","6144:bOW1oWO","6144:OW1oWOQ","6144:W1oWOQ1","6144:1oWOQ1f","6144:oWOQ1f9","6144:WOQ1f9x","6144:OQ1f9xH","6144:Q1f9xHw","6144:1f9xHwm","6144:f9xHwm1","6144:9xHwm1P","6144:xHwm1PX","6144:Hwm1PXB","6144:wm1PXBm","6144:m1PXBmX","6144:1PXBmXZ","6144:PXBmXZF","6144:XBmXZFe","6144:BmXZFeA","6144:mXZFeA2","6144:XZFeA28","6144:ZFeA28p","6144:FeA28pM","6144:eA28pMG","6144:A28pMGE","6144:28pMGEd","6144:8pMGEde","6144:pMGEdeP","6144:MGEdePl","6144:GEdePl9","6144:EdePl9d","6144:dePl9de","6144:ePl9deh","6144:Pl9dehi","6144:l9dehiv","6144:9dehiv8","6144:dehiv80","6144:ehiv80P","6144:hiv80P8","6144:iv80P80","6144:v80P80C","6144:80P80Cn","6144:0P80Cnp","6144:P80CnpZ","3072:VJueTk1","3072:JueTk1O","3072:ueTk1Ow","3072:eTk1Owo","3072:Tk1OwoW","3072:k1OwoWO","3072:1OwoWOQ","3072:OwoWOQ3","3072:woWOQ3d","3072:oWOQ3dw","3072:WOQ3dwa","3072:OQ3dwaW","3072:Q3dwaWB","3072:3dwaWB2","3072:dwaWB28","3072:waWB28a","3072:aWB28ad","3072:WB28ade","3072:B28adeP","3072:28adeP/","3072:8adeP/d","3072:adeP/de","3072:deP/deU","3072:eP/deUv","3072:P/deUv8","3072:/deUv8M"],"imphash":"b7f39532728ce325dc91e2c72b9d27ee"},"file_info":{"file_name":"bounty-13169284224960849","file_type":["peexe","executable"],"file_type_id":"exe","file_size":179181,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1677576839000,"last_seen":1677766207000,"last_multi_scan":1677766207000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor","farfli","fusing","parite"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":40},"sandbox_signatures":{"informative_count":77,"suspicious_count":11,"malicious_count":9,"total":97},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Parite.m02H","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Cson.179181","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[GameThief]/Win32.Magania.dpvu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Spy.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.40447363","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.Shiz-9020206-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Trojan.Agent.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/PcClient.AB.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.40447363 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Farfli.AKJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/GameSpy.db","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0040f83a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-GameThief.Win32.Magania.tzeu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TrjGen.rrqfr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Zegost-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Redosdru.179181","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"BKDR_PCCLIEN.DAM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"BKDR_PCCLIEN.DAM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Generic.BPHG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.SvcHorse.01643","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Magania.Win32.36309","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains the ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Persistence","technique":"Active Setup","attack_id":"T1547.014","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/014","identifiers":[{"type":"informative","value":"Modifies auto-execute functionality by setting/creating a value in the registry (Active Setup)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to write data into process memory (API string)"},{"type":"informative","value":"Contains ability to install a hook procedure (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to create thread in the virtual address space of another process (API string)"},{"type":"malicious","value":"Calls an API typically used to create a thread in another process"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Adjusts debug privileges"},{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"informative","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Rename files"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Found debugger evasion api strings"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Defense Evasion","technique":"Binary Padding","attack_id":"T1027.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/001","identifiers":[{"type":"informative","value":"PE file contains data exceeding the last FAT sector (overlay)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate processes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains the ability to enumerate system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to take screen capture of the target machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Process binds to unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"userinit.exe\" called \"LoadResource\" (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create thread in the virtual address space of another process (API string)","description":"Observed api string:\"CreateRemoteThread\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to install a hook procedure (API string)","description":"Observed api string:\"SetWindowsHookExA\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write data into process memory (API string)","description":"Observed api string:\"WriteProcessMemory\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Observed string:\"ChangeServiceConfigA\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Rename files","description":"\".exe\" renamed original file\"%TEMP%\\907379812_res.tmp\" to \"%TEMP%\\907379859_lang.dll\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"SetUnhandledExceptionFilter\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found debugger evasion api strings","description":"Observed string:\"OutputDebugString\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found - (Indicator: \"des\") in Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin\n Found - (Indicator: \"des\") in Source: 00000000-00002168-00000BC0-5962844\n Found - (Indicator: \"rsa\") in Source: 00000000-00002168-00000BC0-5963944","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\"userinit.exe\" called \"IsWow64Process\" with parameter \"2168\" - (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"userinit.exe\" called \"GetWindowTextW\" (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"userinit.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00002168)\n \"userinit.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003560)\n \"userinit.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002168)\n \"userinit.exe\" called \"RtlGetVersion\" (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"userinit.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"userinit.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"~MHZ\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size (API string)","description":"Observed string:\"GetDiskFreeSpaceExA\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"userinit.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"GetWindowText\"[Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed string:\"GetVersion \" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]\n Observed string:\"GetVersionExA \" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Observed API string:\"GetVolumeInformation\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"userinit.exe\" (Thread ID: 3516) slept \"520\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"userinit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"userinit.exe\" - (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"211.173.73.165:2333\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 907379812_res.tmp)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"ResumeThread\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]\n Observed API string:\"CreateThread\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"907379812_res.tmp\" contains export function called \"ServiceMain\" at ordinal 1\n \"907379812_res.tmp\" contains export function called \"UninstallServer\" at ordinal 2","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\"\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\"\n \"SYSTEM\\CurrentControlSet\\Services\\%s\"\n \"SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\\"\n \"SYSTEM\\CurrentControlSet\\Services\\%s\\Parameters\"\n \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\"\n \"SYSTEM\\CurrentControlSEt\\Services\\\"\n \"Software\\Microsoft\\Active Setup\\Installed Components\\\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate system service (API string)","description":"Observed string:\"OpenSCManagerA\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]\n Observed string:\"OpenServiceA\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"DBWinMutex\"\n \"h+TxYg7/Om/G4vtlI/yIe3NIhOS4R3byFAGYihrz9go=\"\n \"\\Sessions\\1\\BaseNamedObjects\\h+TxYg7/Om/G4vtlI/yIe3NIhOS4R3byFAGYihrz9go=\"\n \"\\Sessions\\1\\BaseNamedObjects\\AMResourceMutex3\"\n \"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"AMResourceMutex3\"\n \"{9ACAF341-7A92-461e-9764-8B1DF6D8D595}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{9ACAF341-7A92-461e-9764-8B1DF6D8D595}\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"%WINDIR%\\SYSTEM32\\APPHELP.DLL\" at base 75420000\n \".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 72a30000\n \".exe\" loaded module \"KERNEL32\" at base 75d20000\n \".exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE.DLL\" at base 6ccb0000\n \"userinit.exe\" loaded module \"ADVAPI32.DLL\" at base 75bc0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"\n0$h@KERNELBASE.dll\"\n \"@api-ms-win-downlevel-advapi32-l1-1-0.dll\"\n \"\nah@KERNELBASE.dll\"\n \"@ADVAPI32.dll\"\n \"8ol@ADVAPI32.dll\"\n \"@WININET.dll\"\n \"?@WININET.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"userinit.exe\" touched \"Filter Mapper2\" (Path: \"HKCU\\CLSID\\{CDA42200-BD88-11D0-BD4E-00A0C911CE86}\\TREATAS\")\n \"userinit.exe\" touched \"Filter Graph\" (Path: \"HKCU\\CLSID\\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\")\n \"userinit.exe\" touched \"DirectSound Audio Renderer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{79376820-07D0-11CF-A24D-0020AFD79767}\")\n \"userinit.exe\" touched \"Capture Graph Builder 2\" (Path: \"HKCU\\CLSID\\{BF87B6E1-8C27-11D0-B3F0-00AA003761C5}\\TREATAS\")\n \"userinit.exe\" touched \"System Device Enumerator\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\\TREATAS\")\n \"userinit.exe\" touched \"VFW Capture Class Manager\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\\TREATAS\")\n \"userinit.exe\" touched \"System Clock\" (Path: \"HKCU\\CLSID\\{E436EBB1-524F-11CE-9F53-0020AF0BA770}\\TREATAS\")\n \"userinit.exe\" touched \"Computer\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"PE file contains data exceeding the last FAT sector (overlay)","description":"Pe file has overlay in bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin","origin":"Static Parser","mitre_attack_id":"T1027.001","relevance":1,"id":"static-131","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"907379812_res.tmp\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin\" has an writable section named \".data\"\n \"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin\" has an writable section named \".CRT\"\n \"907379812_res.tmp\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$27","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"userinit.exe\" (UID: 00000000-00002168) was launched with new environment variables: \"__COMPAT_LAYER=\"VistaSetup\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"userinit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"userinit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"userinit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"userinit.exe\" (UID: 00000000-00002168)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"userinit.exe\" (UID: 00000000-00002168)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"userinit.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"\"CreateServiceA\" (Indicator: \"CreateService\"; File: \"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"907379812_res.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\907379812_res.tmp]- [targetUID: 00000000-00003560]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry (Active Setup)","description":"\"userinit.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{9ACAF341-7A92-461E-9764-8B1DF6D8D595}\"; Key: \"STUBPATH\"; Value: \"0000\")\n \"userinit.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{9ACAF341-7A92-461E-9764-8B1DF6D8D595}\"; Key: \"(DEFAULT)\"; Value: \"CF00B500CD00B300C900E800D600C3000000\"), \"userinit.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{9ACAF341-7A92-461E-9764-8B1DF6D8D595}\")","origin":"Registry Access","mitre_attack_id":"T1547.014","relevance":8,"id":"registry-85","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"userinit.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$28","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$29","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"https://\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin\"\n YARA signature for AES encryption matched on file \"907379812_res.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin\"\n YARA signature for RC4 encryption matched on file \"907379812_res.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed api string:\"SystemParametersInfoA\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"userinit.exe\" called \"GetLogicalDriveStringsA\" (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"userinit.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$2a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Observed string:\"OpenClipboard\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]\n Observed string:\"GetClipboardData\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 907379812_res.tmp)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed api string:\"GetDriveTypeA\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindFirstFileA\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]\n Observed api string:\"FindNextFileA\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed api string:\"Process32Next\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]\n Observed api string:\"Process32First\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]\n Observed api string:\"CreateToolhelp32Snapshot\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Observed api string:\"GetLogicalDriveStringsA\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed api string:\"GetSystemMetrics\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to take screen capture of the target machine (API string)","description":"Observed api string:\"CreateCompatibleBitmap\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"System Security","name":"Contains ability to enable or disable privileges in the specified access token (API string)","description":"Observed api string:\"AdjustTokenPrivileges\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed api string:\"SeDebugPrivilege which can Debug programs\"[Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]\n Observed api string:\"SeShutdownPrivilege which can Shut down the system\"[Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"userinit.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\PCRATSTACT\"; Key: \"TYPE\"; Value: \"20010000\")\n \"userinit.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\PCRATSTACT\")\n \"userinit.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$2c","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"userinit.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Observed string:\"ExitWindowsEx\" [Source: bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin]","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"907379812_res.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\907379812_res.tmp]- [targetUID: 00000000-00003560]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"userinit.exe\" wrote bytes \"fae66777e1a66c772e716c77ee296c7785e267776da06c7726e46777d16d6c77003d6a77804b6a7700000000ad3786778b2d8677b641867700000000\" to virtual address \"0x749E1000\" (part of module \"WSHTCPIP.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin\" was detected as \"Nullsoft PiMP Install System\"\n \"907379812_res.tmp\" was detected as \"Microsoft visual C++ 6.0 DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"userinit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"\"regedit.exe\" (Indicator: \"regedit.exe\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"59/69 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"907379812_res.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\907379812_res.tmp]- [targetUID: 00000000-00003560]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\".exe\" wrote 59392 bytes starting with PE header signature to file \"%TEMP%\\907379812_res.tmp\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"3.4.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"suspicious","category":"Network Related","name":"Process binds to unusual ports","description":"Process \"%WINDIR%\\system32\\userinit.exe\" binds to port 49175","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":10,"id":"network-36","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%TEMP%\\907379812_res.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\907379812_RES.TMP\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\".exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin\" claimed CRC 198164 while the actual is CRC 234662","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin\" has an entrypoint in section \".data\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"StartServiceA\n RegCloseKey\n OpenProcessToken\n CreateServiceA\n ChangeServiceConfigA\n RegCreateKeyExA\n RegOpenKeyExA\n RegCreateKeyA\n CreateToolhelp32Snapshot\n WriteProcessMemory\n Process32First\n GetFileAttributesA\n CopyFileA\n OutputDebugStringA\n GetModuleFileNameA\n LoadLibraryA\n Process32Next\n CreateRemoteThread\n OpenProcess\n CreateDirectoryA\n DeleteFileA\n VirtualAllocEx\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n GetModuleHandleA\n WriteFile\n GetSystemDirectoryA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n FindResourceA\n ShellExecuteA\n RegDeleteKeyA\n SetSecurityDescriptorDacl\n RegOpenKeyA\n RegEnumKeyExA\n RegDeleteValueA\n GetDriveTypeA\n CreateThread\n GetVersionExA\n GetStartupInfoA\n GetFileSize\n FindFirstFileA\n CreateFileMappingA\n FindNextFileA\n MapViewOfFile\n VirtualAlloc\n GetModuleFileNameExA\n FindWindowA\n GetClipboardData\n GetWindowThreadProcessId\n GetCursorPos\n SetWindowsHookExA\n InternetReadFile\n socket\n recv\n send\n WSAStartup\n connect\n closesocket","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to create a thread in another process","description":"\".exe\" called \"CreateRemoteThread\" (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessA\" with parameter \"userinit.exe\" - (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"PE file contains executable resources","description":"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.bin has PE file in resource with name: \"EXE\" and filetype:PE32 executable (DLL) (GUI) Intel 80386\n for MS Windows","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"59/69 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"61/69 Antivirus vendors marked dropped file \"907379812_res.tmp\" as malicious (classified as \"Backdoor.Generic\" with 88% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 1500 bytes to a remote process \"%WINDIR%\\System32\\userinit.exe\" (Handle: 336)\n \".exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\userinit.exe\" (Handle: 336)\n \".exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\userinit.exe\" (Handle: 336)\n \".exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\userinit.exe\" (Handle: 336)\n \".exe\" wrote 55 bytes to a remote process \"%WINDIR%\\System32\\userinit.exe\" (Handle: 336)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 211.173.73.165 on port 2333","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":76,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor","farfli","fusing","parite"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6400b1f311733890df056cb7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Backdoor.Generic","contacted_countries":["KOR"],"submit_name":"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.exe","analysis_start_time":"2023-03-02T14:25:56+00:00","indicators_count":{"informative":77,"suspicious":19,"malicious":11},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"211.173.73.165","port":2333,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}],"processes":[{"pid":3560,"ppid":0,"name":"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.exe","command_line":"","sha256":"bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996","normalized_path":"C:\\bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996.exe","uid":"00000000-00003560","icon":"$2d"},{"pid":2168,"ppid":3560,"name":"userinit.exe","command_line":"","sha256":"538fe1012fedc72727a8de0c2c01944b3d35c29812ecef88e95aac07235e0b0b","normalized_path":"%WINDIR%\\system32\\userinit.exe","parent_uid":"00000000-00003560","uid":"00000000-00002168"}],"all_imported_dlls":["ole32.dll","apphelp.dll","sspicli.dll","oleaut32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","wininet.dll","avicap32.dll","dnsapi.dll","winrnr.dll","FWPUCLNT.DLL","lpk.dll","api-ms-win-downlevel-version-l1-1-0.dll","iertutil.dll","rpcrt4.dll","samcli.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","imm32.dll","WSHTCPIP.DLL","msasn1.dll","comctl32.dll","dwmapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","devenum.dll","normaliz.dll","nlaapi.dll","usp10.dll","ws2_32.dll","nsi.dll","mswsock.dll","fltLib.dll","rpcss.dll","sechost.dll","profapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","NapiNSP.dll","propsys.dll","user32.dll","msacm32.dll","sfc.dll","setupapi.dll","rasadhlp.dll","cryptbase.dll","ntmarta.dll","msvfw32.dll","pnrpnsp.dll","AcGenral.dll","uxtheme.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","ntdll.dll","kernel32.dll","advapi32.dll","userenv.dll","cfgmgr32.dll","devobj.dll","mpr.dll","msctf.dll","shlwapi.dll","urlmon.dll","api-ms-win-core-synch-l1-2-0.dll","Wldap32.dll","msvcp60.dll","clbcatq.dll","KernelBase.dll","shell32.dll","quartz.dll","psapi.dll","gdi32.dll","winmm.dll","qcap.dll","wintrust.dll","msvcrt.dll","msdmo.dll","907379859_lang.dll","version.dll","sfc_os.dll","crypt32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"907379812_res.tmp","sha256":"bd84ba683afa034697291e72a5c37efa43ff5c5f1a7af8a5f2c24e246499492f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{9ACAF341-7A92-461E-9764-8B1DF6D8D595}\\","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\PCRATSTACT\\","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\RNG\\","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\PCRATSTACT\\INSTALLMODULE\\INSTALLMODULE","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]}]},"mutex_activity":{"mutex_created":[{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"h+TxYg7/Om/G4vtlI/yIe3NIhOS4R3byFAGYihrz9go=","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\h+TxYg7/Om/G4vtlI/yIe3NIhOS4R3byFAGYihrz9go=","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\AMResourceMutex3","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"AMResourceMutex3","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"{9ACAF341-7A92-461e-9764-8B1DF6D8D595}","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{9ACAF341-7A92-461e-9764-8B1DF6D8D595}","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6400b1f311733890df056cb7"}]}]}},"report_ids":{"sandbox_job_ids":["6400b1f311733890df056cb7"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample bf05e2a7bece… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bf05e2a7bece…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample bf05e2a7bece… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bf05e2a7bece…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bf05e2a7becec76c1c9d4754a57b84d02201249d05a5d4b67d59992155587996"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample bf05e2a7bece… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bf05e2a7bece…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]