23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ser.Cerbu.Generic Sample bfec01b50d32… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bfec01b50d32…. Malware family: Ser.Cerbu.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab","keywords":["Malicious","Ser.Cerbu.Generic","malware analysis","sandbox report","threat intelligence","bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab"],"about":{"@type":"SoftwareApplication","name":"WininetMM.exe","applicationCategory":["peexe","executable"],"identifier":"bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ser.Cerbu.Generic","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T414,"" loaded module "MPR.DLL" at base 71960000 "" loaded module "USER32.DLL" at base 75A60000 "" loaded module "%WINDIR%\SYSTEM32\DRPROV.DLL" at base 6FF70000 "" loaded module "%WINDIR%\SYSTEM32\NTLANMAN.DLL" at base 6F450000 "" loaded module "%WINDIR%\SYSTEM32\DAVCLNT.DLL" at base 6F430000 "" loaded module "ADVAPI32.DLL" at base 76C60000 "" loaded module "RPCRT4.DLL" at base 75410000 "" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77040000 "" loaded module "WKSCLI.DLL" at base 73740000 "" loaded module "CSCAPI.DLL" at base 706B0000 "" loaded module "NETUTILS.DLL" at base 73750000 "" loaded module "PROFAPI.DLL" at base 75030000 "" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77040000 "" loaded module "OLEAUT32.DLL" at base 75380000 "" loaded module "SAMLIB.DLL" at base 7436000025:T6bd,Found API call GetVersion@KERNEL32.dll (Target: "bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab.bin.exe.bin", Stream UID: "65059-422-00401900") which is directly followed by "cmp eax, 80000000h" and "jnc 00401997h". See related instructions: "... +0 sub esp, 00000118h +6 mov eax, dword ptr [00417074h] +11 xor eax, esp +13 mov dword ptr [esp+00000114h], eax +20 push esi +21 push edi +22 mov edi, dword ptr [esp+00000124h] +29 call dword ptr [004130ECh] ;GetVersion +35 cmp eax, 80000000h +40 jnc 00401997h" ... at 65059-422-00401900 Found API call GetVersion@KERNEL32.DLL (Target: "bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab.bin.exe", Stream UID: "00129812-00002104-9145-292-00401900") which is directly followed by "cmp eax, 80000000h" and "jnc 00401997h". See related instructions: "... +0 sub esp, 00000118h +6 mov eax, dword ptr [00417074h] +11 xor eax, esp +13 mov dword ptr [esp+00000114h], eax +20 push esi +21 push edi +22 mov edi, dword ptr [esp+00000124h] +29 call dword ptr [004130ECh] ;GetVersion +35 cmp eax, 80000000h +40 jnc 00401997h" ... at 00129812-00002104-9145-292-00401900 Found API call GetVersion@KERNEL32.DLL (Target: "bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab.bin.exe", Stream UID: "00129812-00002104-13888-292-00401900") which is directly followed by "cmp eax, 80000000h" and "jnc 00401997h". See related instructions: "... +0 sub esp, 00000118h +6 mov eax, dword ptr [00417074h] +11 xor eax, esp +13 mov dword ptr [esp+00000114h], eax +20 push esi +21 push edi +22 mov edi, dword ptr [esp+00000124h] +29 call dword ptr [004130ECh] ;GetVersion +35 cmp eax, 80000000h +40 jnc 00401997h" ... at 00129812-00002104-13888-292-0040190026:T450,"" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES", Value: "00000000040000000400000000000000") "" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")27:T56b,"" opened "%WINDIR%\SYSTEM32\sechost.dll" with delete access "" opened "%WINDIR%\system32\srvcli.dll" with delete access "" opened "%WINDIR%\system32\wkscli.dll" with delete access "" opened "%WINDIR%\system32\IMM32.DLL" with delete access "" opened "%WINDIR%\system32\uxtheme.dll" with delete access "" opened "%WINDIR%\system32\dwmapi.dll" with delete access "" opened "\Device\KsecDD" with delete access "" opened "%WINDIR%\system32\shell32.dll" with delete access "" opened "%WINDIR%\system32\PROPSYS.dll" with delete access "" opened "%WINDIR%\WindowsShell.Manifest" with delete access "" opened "%WINDIR%\System32\ieframe.dll" with delete access "" opened "C:" with delete access "" opened "IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#5&106af171&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" with delete access "" opened "STORAGE#Volume#{8177f4e1-b53f-11e4-a9c2-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" with delete access "" opened "STORAGE#Volume#{8177f4e1-b53f-11e4-a9c2-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" with delete access "" opened "Z:" with delete access1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790268306141,"unified_at":"2026-09-24T16:45:06.141Z","metadata":{"hashes":{"sha256":"bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab","sha1":"c27d41217a7dccd3ed75c32eba181284401acb8b","md5":"2611061522cb8b119c6772524e202361","sha512":"c7212263e3b8ece99c907e376e63133043a7c43a1841f3f8ec066e208f1f7a6e7f2bb6e13ae4df001b5edaf7b229511b426c17d11f137454bec883f67b1a5dd0","ssdeep":"1536:vWAUCkkEVMIt34OwKmBiRehS7JpdrF8rtv8kjtfszK5fT:oCkkoMIN96TojetfszK5fT","ssdeep_chunks":["1536:vWAUCkk","1536:WAUCkkE","1536:AUCkkEV","1536:UCkkEVM","1536:CkkEVMI","1536:kkEVMIt","1536:kEVMIt3","1536:EVMIt34","1536:VMIt34O","1536:MIt34Ow","1536:It34OwK","1536:t34OwKm","1536:34OwKmB","1536:4OwKmBi","1536:OwKmBiR","1536:wKmBiRe","1536:KmBiReh","1536:mBiRehS","1536:BiRehS7","1536:iRehS7J","1536:RehS7Jp","1536:ehS7Jpd","1536:hS7Jpdr","1536:S7JpdrF","1536:7JpdrF8","1536:JpdrF8r","1536:pdrF8rt","1536:drF8rtv","1536:rF8rtv8","1536:F8rtv8k","1536:8rtv8kj","1536:rtv8kjt","1536:tv8kjtf","1536:v8kjtfs","1536:8kjtfsz","1536:kjtfszK","1536:jtfszK5","1536:tfszK5f","1536:fszK5fT","3072:vWAUCkk","3072:WAUCkkE","3072:AUCkkEV","3072:UCkkEVM","3072:CkkEVMI","3072:kkEVMIt","3072:kEVMIt3","3072:EVMIt34","3072:VMIt34O","3072:MIt34Ow","3072:It34OwK","3072:t34OwKm","3072:34OwKmB","3072:4OwKmBi","3072:OwKmBiR","3072:wKmBiRe","3072:KmBiReh","3072:mBiRehS","3072:BiRehS7","3072:iRehS7J","3072:RehS7Jp","3072:ehS7Jpd","3072:hS7Jpdr","3072:S7JpdrF","3072:7JpdrF8","3072:JpdrF8r","3072:pdrF8rt","3072:drF8rtv","3072:rF8rtv8","3072:F8rtv8k","3072:8rtv8kj","3072:rtv8kjt","3072:tv8kjtf","3072:v8kjtfs","3072:8kjtfsz","3072:kjtfszK","3072:jtfszK5","3072:tfszK5f","3072:fszK5fT","1536:oCkkoMI","1536:CkkoMIN","1536:kkoMIN9","1536:koMIN96","1536:oMIN96T","1536:MIN96To","1536:IN96Toj","1536:N96Toje","1536:96Tojet","1536:6Tojetf","1536:Tojetfs","1536:ojetfsz","1536:jetfszK","1536:etfszK5"],"imphash":"61a449168a0c0b968c6b2877ff89db93"},"file_info":{"file_name":"WininetMM.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":95744,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295736000,"last_seen":1676849598000,"last_multi_scan":1676849598000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":17,"malicious_count":4,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Sakto","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1210027","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ser.Cerbu.3723","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Sakto-9852693-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ser.Cerbu.3723 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Sacto.G trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/Aidbe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Sakto.vil","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"BackDoor-FCBB!2611061522CB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dwn.eauruh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Sacto-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.Sakto.95744.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Sakto.Win32.29","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ser.Cerbu.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00129812-00002104-9145-136-0040CB92\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00129812-00002104-13888-136-0040CB92","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.dll at 65059-302-0040278D\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00129812-00002104-9145-175-0040278D\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00129812-00002104-13888-175-0040278D","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"timeofindia.vicp.net\"\n \"timeofindia.oicp.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"IESQMMUTEX_0_208\"\n \"MyAPP\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\!IETld!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$24","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"WNetOpenEnumW@MPR.dll\"\n \"NPGetCaps@drprov.dll\"\n \"NPGetUser@drprov.dll\"\n \"NPAddConnection@drprov.dll\"\n \"NPAddConnection3@drprov.dll\"\n \"NPGetReconnectFlags@drprov.dll\"\n \"NPCancelConnection@drprov.dll\"\n \"NPGetConnection@drprov.dll\"\n \"NPGetConnection3@drprov.dll\"\n \"NPGetUniversalName@drprov.dll\"\n \"NPOpenEnum@drprov.dll\"\n \"NPEnumResource@drprov.dll\"\n \"NPCloseEnum@drprov.dll\"\n \"NPGetResourceParent@drprov.dll\"\n \"NPGetResourceInformation@drprov.dll\"\n \"NPGetCaps@ntlanman.dll\"\n \"NPGetUser@ntlanman.dll\"\n \"NPAddConnection@ntlanman.dll\"\n \"NPAddConnection3@ntlanman.dll\"\n \"NPGetReconnectFlags@ntlanman.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 00129812-00002104-76F4228D-141531\n GetUserNameExW@SSPICLI.DLL at 00129812-00002104-76F4228D-145173\n GetUserNameW@ADVAPI32.dll at 65059-418-00402160\n GetUserNameW@ADVAPI32.DLL at 00129812-00002104-9145-289-00402160\n GetUserNameW@ADVAPI32.DLL at 00129812-00002104-13888-289-00402160","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Office Start.lnk.144781\" has type \"MS Windows shortcut, Item id list present, Has command line arguments, ctime=Mon Jan 1 06:50:36 1601, mtime=Mon Jan 1 06:50:36 1601, atime=Mon Jan 1 06:50:36 1601, length=0, window=hide\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"timeofindia.vicp.net\"\n Heuristic match: \"timeofindia.oicp.net\"\n Heuristic match: \"meofindia.vicp.net\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceA@SECHOST.DLL at 00129812-00002104-76F4228D-148581","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 65059-469-004105D5\n SetUnhandledExceptionFilter@KERNEL32.dll at 65059-697-0040BD6E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00129812-00002104-9145-16-00406F00\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00129812-00002104-9145-17-00404D03\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00129812-00002104-9145-322-004105D5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00129812-00002104-9145-525-0040BD6E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00129812-00002104-13888-16-00406F00\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00129812-00002104-13888-17-00404D03\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00129812-00002104-13888-322-004105D5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00129812-00002104-13888-525-0040BD6E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 65059-422-00401900\n RasRpcGetVersion@RASMAN.DLL at 00129812-00002104-76F4228D-148343\n GetVersion@KERNEL32.DLL at 00129812-00002104-9145-292-00401900\n GetVersion@KERNEL32.DLL at 00129812-00002104-13888-292-00401900","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Makes a branch decision directly after calling an API that is environment aware","description":"$25","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 65059-374-00411AB0\n GetProcessHeap@KERNEL32.DLL at 00129812-00002104-9145-245-00411AB0\n GetProcessHeap@KERNEL32.DLL at 00129812-00002104-13888-245-00411AB0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Office Start.lnk\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" created file \"C:\\Windows\\system32\\en-US\\urlmon.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00129812-00002104-76F4228D-147002\n RasPortListen@RASMAN.DLL at 00129812-00002104-76F4228D-147974","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"WriteFile\n CreateFileA\n OpenProcess\n GetFileSize\n CreateFileW\n FindNextFileW\n FindFirstFileW\n GetComputerNameW\n TerminateProcess\n Process32FirstW\n CreateThread\n CreateProcessW\n GetStartupInfoW\n DeleteFileW\n GetDriveTypeW\n GetModuleFileNameW\n LoadLibraryW\n GetModuleFileNameA\n GetVersionExW\n LoadLibraryA\n GetProcAddress\n GetTickCount\n Sleep\n VirtualAlloc\n GetCommandLineA\n GetStartupInfoA\n UnhandledExceptionFilter\n IsDebuggerPresent\n GetModuleHandleW\n GetUserNameW\n RegEnumKeyA\n RegOpenKeyExA\n RegOpenKeyExW\n RegCloseKey\n OpenProcessToken\n InternetQueryOptionW\n HttpSendRequestW\n InternetOpenW\n InternetConnectW\n HttpSendRequestExW\n InternetCloseHandle\n InternetReadFile\n InternetWriteFile","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLEFILETRACING\", Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLECONSOLETRACING\", Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"FILETRACINGMASK\", Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"CONSOLETRACINGMASK\", Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"33/56 Antivirus vendors marked sample as malicious (58% detection rate)\n 22/43 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"33/56 Antivirus vendors marked sample as malicious (58% detection rate)\n 22/43 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$26","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$27","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053eb765858ec76186aec76653ced760000000000bf91760000000056cc9176000000007cca917600000000376808756a2ced76d62ded7600000000206908750000000029a6917600000000a48d087500000000f70e917600000000\" to virtual address \"0x752D1000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"7739e97679a8ed76be72ed76d62ded761de2e87605a2ed76c868ec7657d1f376bee3e876616fed766841eb760050eb7600000000ad37fc768b2dfc76b641fc7600000000\" to virtual address \"0x74A01000\" (part of module \"WSHIP6.DLL\")\n \"\" wrote bytes \"92e6e87679a8ed76be72ed76d62ded761de2e87605a2ed76bee3e876616fed766841eb760050eb7600000000ad37fc768b2dfc76b641fc7600000000\" to virtual address \"0x744F1000\" (part of module \"WSHTCPIP.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":29,"imported_dlls_count":110,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":29,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":14,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"56e40ca0aac2ed98699a275e","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Graftor","contacted_countries":["ZZZ"],"submit_name":"WininetMM.exe","analysis_start_time":"2016-03-12T06:33:50+00:00","indicators_count":{"informative":8,"suspicious":19,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"56e409f4aac2ed8d059a275e","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","error_type":"Failed to save report to webservice","verdict":"malicious","threat_score":93,"malware_family":"Gen:Variant.Graftor","contacted_countries":["ZZZ"],"submit_name":"bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab.bin","analysis_start_time":"2016-03-12T15:29:23+00:00","indicators_count":{"informative":9,"suspicious":14,"malicious":5},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"timeofindia.vicp.net","address":"0.0.0.0","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"domain":"timeofindia.oicp.net","address":"0.0.0.0","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}],"processes":[{"pid":2104,"ppid":0,"name":"bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab.bin.exe","command_line":"","normalized_path":"","uid":"00129812-00002104","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAACiSURBVFhH7ZdBDoAgDAT7/0+rRDDrugVO4GFJjLHaUKYeOnFcKyK2XHXvKPctqx78LqA8IA2OMalWMeZhrMVVHu3lAkzABEzABEzABEzABEzgJwR2zOWfsXyloMC4/m7BChJdL8hEgkWDxUTJzShHmhESyGyJbQhbh4Vk9jQkoLQsU7UZhVMFD/+BzPlmCpk5+VMAC6lK7iFWfebvuS3tfYmf8Z2c4mVxH3AAAAAASUVORK5CYII="}],"all_imported_dlls":["netutils.dll","SspiCli.dll","SETUPAPI.dll","MPR.dll","RASAPI32.dll","winrnr.dll","ws2_32.DLL","GDI32.dll","MSASN1.dll","uxtheme.dll","SAMLIB.dll","napinsp.dll","ole32.dll","VERSION.dll","ntmarta.dll","fwpuclnt.dll","USP10.dll","CRYPTBASE.dll","wkscli.dll","kernel32.dll","USER32.dll","shell32.dll","ntlanman.dll","WININET.dll","NETAPI32.dll","OLEAUT32.dll","davclnt.dll","sensapi.dll","urlmon.dll","msvcrt.dll","ieframe.dll","rtutils.dll","MSCTF.dll","dwmapi.dll","cscapi.dll","Normaliz.dll","ntdll.dll","PSAPI.DLL","iphlpapi.DLL","mswsock.dll","LPK.dll","KERNELBASE.dll","SHLWAPI.dll","iertutil.dll","CLBCatQ.DLL","PROPSYS.dll","rasman.dll","rasadhlp.dll","sechost.dll","ADVAPI32.dll","comctl32.dll","apphelp.dll","dnsapi.DLL","wship6.dll","drprov.dll","NLAapi.dll","wshtcpip.dll","IMM32.DLL","srvcli.dll","RPCRT4.dll","CRYPT32.dll","profapi.dll","USERENV.dll","pnrpnsp.dll","DEVOBJ.dll","CFGMGR32.dll","SAMCLI.DLL","wintrust.dll","netapi32.dll","msctf.dll","clbcatq.dll","rasapi32.dll","KernelBase.dll","user32.dll","ws2_32.dll","gdi32.dll","wininet.dll","userenv.dll","oleaut32.dll","setupapi.dll","IPHLPAPI.DLL","psapi.dll","version.dll","samcli.dll","oleacc.dll","devobj.dll","msasn1.dll","samlib.dll","normaliz.dll","lpk.dll","cryptbase.dll","nsi.dll","winnsi.dll","NapiNSP.dll","FWPUCLNT.DLL","shlwapi.dll","imm32.dll","dnsapi.dll","schannel.dll","usp10.dll","crypt32.dll","nlaapi.dll","WSHTCPIP.DLL","rpcrt4.dll","propsys.dll","Wldap32.dll","advapi32.dll","cfgmgr32.dll","sspicli.dll","SensApi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Office Start.lnk","sha256":"c4759586d0dd07559f3888af150db237ba3f247ce93a2dbda7f94ba6f1d63a6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]}],"files_written":[{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"path":"%SAMPLEDIR%\\bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab.bin.exe","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Office Start.lnk","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\mllvd7rr.default\\prefs.js","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"PIPE\\samr","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"},{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"C:\\WininetMM.exe","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"path":"%SAMPLEDIR%\\","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]}]},"mutex_activity":{"mutex_created":[{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"MyAPP","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"56e409f4aac2ed8d059a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MyAPP","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"56e40ca0aac2ed98699a275e"}]}]}},"report_ids":{"sandbox_job_ids":["56e40ca0aac2ed98699a275e","56e409f4aac2ed8d059a275e"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Ser.Cerbu.Generic Sample bfec01b50d32… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bfec01b50d32…. Malware family: Ser.Cerbu.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab"}],["$","meta","4",{"property":"og:title","content":"Malicious Ser.Cerbu.Generic Sample bfec01b50d32… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bfec01b50d32…. Malware family: Ser.Cerbu.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bfec01b50d32f31b33dccef83e93c43532a884ec148f4229d40cbd9fdc88b1ab"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ser.Cerbu.Generic Sample bfec01b50d32… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bfec01b50d32…. Malware family: Ser.Cerbu.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]