24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious HackTool/ConnectWiseControl.b Sample bf11c53afe13… — Score 71/100 — Hybrid Analysis","description":"Malicious verdict for sample bf11c53afe13…. Malware family: HackTool/ConnectWiseControl.b. Threat score 71/100. 6/27 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2","keywords":["Malicious","HackTool/ConnectWiseControl.b","malware analysis","sandbox report","threat intelligence","bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2"],"about":{"@type":"SoftwareApplication","name":"support.client.exe","applicationCategory":["peexe","executable"],"identifier":"bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2","additionalType":"Malicious sample"},"threatScore":71,"malwareFamily":"HackTool/ConnectWiseControl.b","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4f6,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp")26:T8d2,Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found reference to "/crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CIL" (Indicator: "SHA384"; Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp")27:Tb03,Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found api reference "CertFindAttribute" (Indicator: "CertFindAttribute"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found api reference "CertFindAttribute" (Indicator: "CertFindAttribute"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp")28:Tfec,Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-120-00425BF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-120-00425BF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-355-00438863 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-355-00438863 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 43851-366-00439702 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 43851-366-00439702 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 43851-366-00439702 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 43851-366-00439702 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-878-0040CB70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-878-0040CB70 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-940-004361A9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-940-004361A9 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-941-0042776C Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-941-0042776C Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1013-0040EF17 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1013-0040EF17 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1016-00427C0C Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1016-00427C0C Assembly shows XOR instruction xor eax dword ptr [00448000h] in Stream UID: 43851-1022-00427076 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1029-00427ADC Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1029-00427ADC Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1043-00427D2C Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1043-00427D2C Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1046-0042BCAF Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1046-0042BCAF Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1084-0040EEB5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1084-0040EEB5 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1107-004278A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1107-004278A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1142-00436E08 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1142-00436E08 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1143-00436A23 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1143-00436A23 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1144-00436BF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1144-00436BF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1145-00436B02 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1145-00436B02 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1146-0043678D Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1146-0043678D Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1873-00424C1B Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1873-00424C1B Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1950-00427CCA Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1950-00427CCA Assembly shows XOR instruction xor edx dword ptr [00448000h] in Stream UID: 43851-1957-004271F6 Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1962-0042784F Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1962-0042784F Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1963-004279AA Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1963-004279AA Assembly shows XOR instruction xor eax ebp in Stream UID: 43851-1965-00427A7B Assembly shows XOR instruction xor ecx ebp in Stream UID: 43851-1965-00427A7B29:T70c,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp")2a:T476,Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp")2b:Teec,"705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0uz" - Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0mm*v;z" - Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampinhttp://ocsp.digicert.com0xx.-r*^[0digicert" - Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found URL "http://www.digicert.com/cps0csp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0vupuvu/1(0&0$0" - Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:" - Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021cilmhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps00$slhttp://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0uz" - Source: "00000000-00008176.00000000.81325.02B9C000.00000004.mdmp")37:T9e4,"" (Indicator: "GetDC"; Source: "00000000-00008176.00000000.81325.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008176.00000000.81325.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008176.00000000.81325.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008176.00000000.81325.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008176.00000000.81325.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008176.00000000.81325.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008176.00000000.81325.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008176.00000000.81325.02AF0000.00000004.mdmp")39:T472,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp")3a:T5e3,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "bf11c53afe137d5b26bf1bf6d0ac93880787477b1eb571a3b6dcee952b0933f2.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00008176.00000000.81325.0011F000.00000002.mdmp")3b:T1ee7,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008176.00000000.81325.02AF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"699c7a5e3ecca117720bed9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"699c7a5e3ecca117720bed9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00008176.00000000.81325.02AF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"699c7a5e3ecca117720bed9b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"699c7a5e3ecca117720bed9b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"