24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4dd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample cbb36fbfcd50… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cbb36fbfcd50…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 7/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f"],"about":{"@type":"SoftwareApplication","name":"20e384313836ee49f6a3af1ab38eef9c3866f16a.exe","applicationCategory":["peexe","executable"],"identifier":"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":7,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T46e,Observed string: "OpenThreadToken" (Indicator: "OpenThreadToken") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "OpenProcessToken" (Indicator: "OpenProcessToken") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "OpenThreadToken" (Indicator: "OpenThreadToken") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "OpenProcessToken" (Indicator: "OpenProcessToken") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp26:T8a6,Observed string: "VirtualFreeEx" (Indicator: "VirtualFree") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "VirtualAllocEx" (Indicator: "VirtualAlloc") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "VirtualFreeEx" (Indicator: "VirtualFree") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "VirtualAllocEx" (Indicator: "VirtualAlloc") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp27:T46a,Observed string: "GetLocalTime" (Indicator: "GetLocalTime") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetLocalTime" (Indicator: "GetLocalTime") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp28:T5f6,Observed string: "GetDiskFreeSpaceExW" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetDiskFreeSpaceW" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GlobalMemoryStatusEx" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetDiskFreeSpaceExW" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetDiskFreeSpaceW" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GlobalMemoryStatusEx" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]29:T93e,Observed string: "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp2a:T46a,Observed string: "GetLocalTime" (Indicator: "GetLocalTime") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetLocalTime" (Indicator: "GetLocalTime") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp2b:T8b4,Observed api:"GetWindowText"[Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed api:"FindWindow"[Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed api:"EnumWindows"[Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed api:"GetForegroundWindow"[Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed api:"GetWindowText"[Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed api:"FindWindow"[Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed api:"EnumWindows"[Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed api:"GetForegroundWindow"[Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed api:"FindWindow"[Source: 00000000-00004868.00000000.79923.03AA0000.00000004.mdmp] Observed api:"FindWindow"[Source: 00000000-00004868.00000001.81841.03AA0000.00000004.mdmp] Observed api:"FindWindow"[Source: 00000000-00004868.00000002.83763.03AA0000.00000004.mdmp]2c:T6ac,Observed string: "CreateProcessW" (Indicator: "CreateProcess") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "CreateProcessAsUserW" (Indicator: "CreateProcess") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "CreateProcessWithLogonW" (Indicator: "CreateProcess") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "CreateProcessW" (Indicator: "CreateProcess") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "CreateProcessAsUserW" (Indicator: "CreateProcess") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "CreateProcessWithLogonW" (Indicator: "CreateProcess") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp2d:T45a,Observed string: "ShellExecuteExW" (Indicator: "ShellExecute") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "ShellExecuteW" (Indicator: "ShellExecute") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "ShellExecuteExW" (Indicator: "ShellExecute") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "ShellExecuteW" (Indicator: "ShellExecute") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp2e:T456,Observed string: "LogonUserW" (Indicator: "LogonUser") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "LoadUserProfileW" (Indicator: "LoadUserProfile") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "LogonUserW" (Indicator: "LogonUser") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "LoadUserProfileW" (Indicator: "LoadUserProfile") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp2f:T660,Found string "CreateThread" (Indicator: "CreateThread"; File: "cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin") Found string "ResumeThread" (Indicator: "ResumeThread"; File: "cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin") Found string "OpenThreadToken" (Indicator: "OpenThread"; File: "cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin") Found string "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004868.00000000.79923.004AB000.00000080.mdmp, 00000000-00004868.00000000.79923.004C2000.00000004.mdmp, 00000000-00004868.00000001.81841.004AB000.00000080.mdmp, 00000000-00004868.00000001.81841.004C2000.00000004.mdmp, 00000000-00004868.00000002.83763.004AB000.00000080.mdmp, 00000000-00004868.00000002.83763.004C2000.00000004.mdmp") Found string "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004868.00000000.79923.004AB000.00000080.mdmp, 00000000-00004868.00000000.79923.004C2000.00000004.mdmp, 00000000-00004868.00000001.81841.004AB000.00000080.mdmp, 00000000-00004868.00000001.81841.004C2000.00000004.mdmp, 00000000-00004868.00000002.83763.004AB000.00000080.mdmp, 00000000-00004868.00000002.83763.004C2000.00000004.mdmp") Found string "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004868.00000000.79923.004AB000.00000080.mdmp, 00000000-00004868.00000000.79923.004C2000.00000004.mdmp, 00000000-00004868.00000001.81841.004AB000.00000080.mdmp, 00000000-00004868.00000001.81841.004C2000.00000004.mdmp, 00000000-00004868.00000002.83763.004AB000.00000080.mdmp, 00000000-00004868.00000002.83763.004C2000.00000004.mdmp")30:T686,Observed string: "OpenProcess" (Indicator: "OpenProcess") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetProcessHeap" (Indicator: "GetProcessHeap") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "OpenProcessToken" (Indicator: "OpenProcess") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "OpenProcess" (Indicator: "OpenProcess") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetProcessHeap" (Indicator: "GetProcessHeap") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "OpenProcessToken" (Indicator: "OpenProcess") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp31:T452,Observed string: "GetLastError" (Indicator: "GetLastError") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "SetLastError" (Indicator: "SetLastError") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetLastError" (Indicator: "GetLastError") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "SetLastError" (Indicator: "SetLastError") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp32:T47a,Observed string: "ShowWindow" (Indicator: "ShowWindow") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "ShowWindow" (Indicator: "ShowWindow") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp33:T67a,Observed string: "LoadLibraryW" (Indicator: "LoadLibrary") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "LoadLibraryW" (Indicator: "LoadLibrary") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp34:T5e7,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\MPR.DLL" ".exe" trying to access non-existent file "C:\USERENV.DLL" ".exe" trying to access non-existent file "C:\VERSION.DLL" ".exe" trying to access non-existent file "C:\WININET.DLL" ".exe" trying to access non-existent file "C:\WINMM.DLL" ".exe" trying to access non-existent file "C:\WSOCK32.DLL" ".exe" trying to access non-existent file "C:\WINMMBASE.DLL" ".exe" trying to access non-existent file "C:\UXTHEME.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\CLDAPI.DLL" ".exe" trying to access non-existent file "C:\CLDAPI.dll" ".exe" trying to access non-existent file "C:\AEPIC.DLL" ".exe" trying to access non-existent file "C:\AEPIC.dll" ".exe" trying to access non-existent file "C:\BCRYPT.DLL" ".exe" trying to access non-existent file "C:\bcrypt.dll" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" ".exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" ".exe" trying to access non-existent file "C:\DWMAPI.DLL" ".exe" trying to access non-existent file "C:\dwmapi.dll"35:T47c,Observed string: "WNetGetConnectionW" (Indicator: "NetGetConnection") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "WNetAddConnection2W" (Indicator: "NetAddConnection") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "WNetGetConnectionW" (Indicator: "NetGetConnection") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "WNetAddConnection2W" (Indicator: "NetAddConnection") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp36:T45c,Observed string: "InternetOpenW" (Indicator: "InternetOpen") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "InternetOpenUrlW" (Indicator: "InternetOpen") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "InternetOpenW" (Indicator: "InternetOpen") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "InternetOpenUrlW" (Indicator: "InternetOpen") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp37:T1376,Observed string: "CreateCompatibleBitmap" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "CreateCompatibleDC" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetDIBits" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "CreateDCW" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetWindowDC" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetDC" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetDesktopWindow" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "CreateCompatibleBitmap" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "CreateCompatibleDC" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetDIBits" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "CreateDCW" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetWindowDC" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetDC" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetDesktopWindow" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "" [Source: 00000000-00004868.00000000.79923.03AA0000.00000004.mdmp 00000000-00004868.00000001.81841.03AA0000.00000004.mdmp 00000000-00004868.00000002.83763.03AA0000.00000004.mdmp] Observed string: "" [Source: 00000000-00004868.00000000.79923.03AA0000.00000004.mdmp 00000000-00004868.00000001.81841.03AA0000.00000004.mdmp 00000000-00004868.00000002.83763.03AA0000.00000004.mdmp] Observed string: "" [Source: 00000000-00004868.00000000.79923.03AA0000.00000004.mdmp 00000000-00004868.00000001.81841.03AA0000.00000004.mdmp 00000000-00004868.00000002.83763.03AA0000.00000004.mdmp] Observed string: "" [Source: 00000000-00004868.00000000.79923.03AA0000.00000004.mdmp 00000000-00004868.00000001.81841.03AA0000.00000004.mdmp 00000000-00004868.00000002.83763.03AA0000.00000004.mdmp] Observed string: "" [Source: 00000000-00004868.00000000.79923.03AA0000.00000004.mdmp 00000000-00004868.00000001.81841.03AA0000.00000004.mdmp 00000000-00004868.00000002.83763.03AA0000.00000004.mdmp] Observed string: "" [Source: 00000000-00004868.00000000.79923.03AA0000.00000004.mdmp 00000000-00004868.00000001.81841.03AA0000.00000004.mdmp 00000000-00004868.00000002.83763.03AA0000.00000004.mdmp]38:T9de,Observed string: "CreateToolhelp32Snapshot" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "Process32FirstW" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "Process32NextW" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "EnumProcesses" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "EnumProcessModules" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "CreateToolhelp32Snapshot" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "Process32FirstW" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "Process32NextW" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "EnumProcesses" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "EnumProcessModules" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]39:T442,Observed string: "ReadFile" (Indicator: "ReadFile") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "InternetReadFile" (Indicator: "ReadFile") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "ReadFile" (Indicator: "ReadFile") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "InternetReadFile" (Indicator: "ReadFile") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp3a:T682,Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp3b:T1420,Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetTempFileNameW" (Indicator: "GetTempFileName") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetSystemDirectoryW" (Indicator: "GetSystemDirectory") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "FtpGetFileSize" (Indicator: "GetFileSize") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetTempFileNameW" (Indicator: "GetTempFileName") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetSystemDirectoryW" (Indicator: "GetSystemDirectory") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "FtpGetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp3c:Tbb6,Observed string: "GetAsyncKeyState" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetKeyboardState" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetKeyState" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "VkKeyScanW" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "AttachThreadInput" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "MapVirtualKeyW" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetAsyncKeyState" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetKeyboardState" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetKeyState" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "VkKeyScanW" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "AttachThreadInput" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "MapVirtualKeyW" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]3d:T69a,Observed string: "GetUserObjectInformationW" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetNativeSystemInfo" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetSystemInfo" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetSystemMetrics" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetUserObjectInformationW" [Source: 00000000-00004868.00000000.79923.00483000.00000080.mdmp 00000000-00004868.00000001.81841.00483000.00000080.mdmp 00000000-00004868.00000002.83763.00483000.00000080.mdmp] Observed string: "GetNativeSystemInfo" [Source: 00000000-00004868.00000000.79923.00483000.00000080.mdmp 00000000-00004868.00000001.81841.00483000.00000080.mdmp 00000000-00004868.00000002.83763.00483000.00000080.mdmp] Observed string: "GetSystemInfo" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetSystemMetrics" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]3e:T6a2,Observed string: "LookupPrivilegeValueW" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "AdjustTokenPrivileges" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "SeShutdownPrivilege" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "SeDebugPrivilege" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "SeShutdownPrivilege" [Source: 00000000-00004868.00000000.79923.00483000.00000080.mdmp 00000000-00004868.00000001.81841.00483000.00000080.mdmp 00000000-00004868.00000002.83763.00483000.00000080.mdmp] Observed string: "SeDebugPrivilege" [Source: 00000000-00004868.00000000.79923.00483000.00000080.mdmp 00000000-00004868.00000001.81841.00483000.00000080.mdmp 00000000-00004868.00000002.83763.00483000.00000080.mdmp] Observed string: "LookupPrivilegeValueW" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "AdjustTokenPrivileges" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]3f:T1b06,Observed string: "DuplicateTokenEx" which can Creates a new access token that duplicates one already in existence. [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "DuplicateTokenEx" which can Creates a new access token that duplicates an existing token. [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "InitializeSecurityDescriptor" which can Initializes a new security descriptor. [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "InitializeAcl" which can Initializes a new ACL structure. [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetLengthSid" which can Returns the length in bytes of a valid security identifier (SID). [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "CopySid" which can Copies a security identifier (SID) to a buffer. [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetTokenInformation" which can Retrieves a specified type of information about an access token. [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetSecurityDescriptorDacl" which can Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor. [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetAclInformation" which can Retrieves information about an access control list (ACL). [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "GetAce" which can Obtains a pointer to an access control entry (ACE) in an access control list (ACL). [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "AddAce" which can Adds one or more access control entries (ACEs) to a specified access control list (ACL). [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "SetSecurityDescriptorDacl" which can Sets information in a discretionary access control list (DACL). [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "DuplicateTokenEx" which can Creates a new access token that duplicates one already in existence. [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "DuplicateTokenEx" which can Creates a new access token that duplicates an existing token. [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "InitializeSecurityDescriptor" which can Initializes a new security descriptor. [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "InitializeAcl" which can Initializes a new ACL structure. [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetLengthSid" which can Returns the length in bytes of a valid security identifier (SID). [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "CopySid" which can Copies a security identifier (SID) to a buffer. [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetTokenInformation" which can Retrieves a specified type of information about an access token. [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetSecurityDescriptorDacl" which can Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor. [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetAclInformation" which can Retrieves information about an access control list (ACL). [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "GetAce" which can Obtains a pointer to an access control entry (ACE) in an access control list (ACL). [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]40:T5df,Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00004868.00000000.79923.00482000.00000040.mdmp 00000000-00004868.00000001.81841.00482000.00000040.mdmp 00000000-00004868.00000002.83763.00482000.00000040.mdmp Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp41:T91f,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]42:T5f8,Observed string: "SetSystemPowerState" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "InitiateSystemShutdownExW" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "ExitWindowsEx" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin] Observed string: "SetSystemPowerState" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "InitiateSystemShutdownExW" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp] Observed string: "ExitWindowsEx" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp 00000000-00004868.00000000.79923.004C2000.00000004.mdmp 00000000-00004868.00000001.81841.004AB000.00000080.mdmp 00000000-00004868.00000001.81841.004C2000.00000004.mdmp 00000000-00004868.00000002.83763.004AB000.00000080.mdmp 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]43:T40e,Found string ":\WINDOWS\System32\VBoxService.exe" (Indicator: "vboxservice.exe"; Source: "00000000-00004868.00000000.79923.05270000.00000002.mdmp, 00000000-00004868.00000001.81841.05270000.00000002.mdmp, 00000000-00004868.00000002.83763.05270000.00000002.mdmp") Found string ":\Program Files\Wireshark\tshark.exe" (Indicator: "tshark.exe"; Source: "00000000-00004868.00000000.79923.05270000.00000002.mdmp, 00000000-00004868.00000001.81841.05270000.00000002.mdmp, 00000000-00004868.00000002.83763.05270000.00000002.mdmp") Found string ":\Program Files\Wireshark\dumpcap.exe" (Indicator: "dumpcap.exe"; Source: "00000000-00004868.00000000.79923.05270000.00000002.mdmp, 00000000-00004868.00000001.81841.05270000.00000002.mdmp, 00000000-00004868.00000002.83763.05270000.00000002.mdmp") Found string "S\System32\VBoxService.exe" (Indicator: "vboxservice.exe"; Source: "00000000-00004868.00000000.79923.05270000.00000002.mdmp, 00000000-00004868.00000001.81841.05270000.00000002.mdmp, 00000000-00004868.00000002.83763.05270000.00000002.mdmp")44:T55f,RegCreateKeyExW RegCloseKey CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW GetDriveTypeW GetFileAttributesW UnhandledExceptionFilter GetTempPathW DeviceIoControl CopyFileW WriteProcessMemory OutputDebugStringW GetModuleFileNameW IsDebuggerPresent LoadLibraryExW CreateThread GetSystemDirectoryW ExitThread TerminateProcess CreateToolhelp32Snapshot LoadLibraryW GetVersionExW GetTickCount LoadLibraryA GetFileSize OpenProcess GetStartupInfoW ReadProcessMemory CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetComputerNameW WriteFile FindNextFileW FindFirstFileW CreateFileW VirtualAllocEx GetSystemInfo Process32NextW LockResource GetCommandLineW Process32FirstW GetModuleHandleW FindResourceW CreateProcessW Sleep VirtualAlloc EnumProcesses ShellExecuteW ShellExecuteExW GetCursorPos GetClipboardData SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto45:Tcb4,".exe" wrote bytes "00891375" to virtual address "0x0490E010" ".exe" wrote bytes "10f2287700b92777f091df77109d287790922877c0b4287750882877d067287740b22877209c2877108c2877a0a42877507c287750a92877c0b32877805d2877c0e6287790752877c0ee2877a0c4287700c0287710d2277760aa2877" to virtual address "0x048B0228" ".exe" wrote bytes "d05f1075007e1075905c137540981375e0a1107520681375d0d51075104e1075703410753071107500311375807413754012137520421375e0af1375" to virtual address "0x0490E098" ".exe" wrote bytes "7058137540c5157540821375009a16758078107500731075d0141375707d1075002d12756076107520771375c07c1075904f10751066137510361375a07e137570a2107530361075" to virtual address "0x0490E0D8" ".exe" wrote bytes "d0e41375c0e41375a0dc137520b1137590af1375f0561375e086177520c7137540ec137520ee1375" to virtual address "0x0490E958" ".exe" wrote bytes "801f1275a05a1375e0941375d07b1375b01e1275d01d1275f0e31575703f137550fa1075a0801175" to virtual address "0x0490E138" ".exe" wrote bytes "1036f4742036f474" to virtual address "0x048B01A0" ".exe" wrote bytes "10761375a05f137530d51075f0561075a0e71575e07b1075b0d61575b024117510451375204d137590e51575" to virtual address "0x0490E19C" ".exe" wrote bytes "d04acd72c030cd724029cd72f028cd72406ecd720077cd7270b3cd72b0b0cd7290b5cd7220b7cd7220b6cd72a0b6cd72" to virtual address "0x77951038" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "907c1375002b13750039137570a21375b0af1375708c107550741075d0d0157560af137580801375b0841375f05f137530a31375" to virtual address "0x0490E060" ".exe" wrote bytes "00f0d874104cd97460f4da74603dd974b046d974d06bd974b044d974604bd97400fcde74806ddb74b0a0dc74305fdf74d09adc74a048d874" to virtual address "0x048B00D8" ".exe" wrote bytes "705b8f04906a8f0440378f04f06b8f0470688f04d06a8f04e0458f04e03a8f04e0688f04b0698f04b06b8f04b0558f04506a8f04b0718f04406b8f0430698f04806d8f04707a8f0490378f04" to virtual address "0x74D4D000" (part of module "IMM32.DLL") ".exe" wrote bytes "f04c1375c056137530081375c0611275606e137500551375504f1375f0431375501a137550b51575c01b1375f031137550671375" to virtual address "0x0490E164" ".exe" wrote bytes "30aecc77" to virtual address "0x76831094" (part of module "RPCRT4.DLL") ".exe" wrote bytes "6041cc74e030cc74" to virtual address "0x7795176C" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "305fa477f0dba477303ca477f03aa477e00fa577b085a4772008a577607ba477003ca477c03aa477b07aa477" to virtual address "0x77951008" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "10a3cd76e0a7cd7680a0cd76f08ace766069cd76f057cd7620a9cd76008bce7670a8cd76" to virtual address "0x048B0014" ".exe" wrote bytes "d04c617370646173f0406173003f6173205d6173606b6173f0286273c03c6173" to virtual address "0x74072078" (part of module "UXTHEME.DLL") ".exe" wrote bytes "708cd374503cd374c02dd374908fd374c020d374b095d3743025d3747047d374402dd374f0bbd3743049d374a026d3744094d374308ed374c080d37450b8d374d027d374c0ced374f026d374d094d374a084d374" to virtual address "0x737F0100" (part of module "COMCTL32.DLL")46:T48d,NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1595-00450145 NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1368-00440338 NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1652-00454CFC NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1504-0044786A NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1653-00454D4A NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1371-0044048E NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1505-004478AC NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1507-00447ABC NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1148-0042FE05 NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1367-00440306 NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1369-0044036A NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1147-0042FDA6 NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1508-00447B4E NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-845-0046A1F3 NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1506-004479A0 NtdllDialogWndProc_W@NTDLL.DLL at 00000000-00004868-59440-1372-004404E847:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAB3d3d3d3cAAAAAAAAAAA93d3d3d3d3dwAAAAAAAAD3d3d3d3d3d3d/AAAAAAD3d3d3iIiIiId3d3AAAAAPd3d3j4h3d4iIh3d3AAAA93d3j4d2Z3ZneIiHd3AAAPd3eIdmZmd3ZmZ4iHd/AA93d4h0ZmZ3d2ZkR4iHdwD3d3iHRGZnd3d2ZkR4iHdw93eIdEZmZ3d3dmZkR4h3cIeHiGRGZmd3d3ZmZEaIh3d3d4cAAAQAAAAAAAAAeIh3eHiHCIdwCId3d4iIgHh4d3h4dECIhwCIiIiIiARIeId4eHRmeIgEd3d3iPdER3iHeHh0ZkeIgHd3B4hwZkd4h3h4dGZwiIcHcHeIB2ZHeId4eHZndwiIBGB49nd2Z3iHeIh2Z3dniIAHiHZ3dmd4h3iId3d3hHiIiIcId3Z4eId3iId3d4gIiIjwiId3eHh3h4iHd3iIh4iId4iHd3eId/eIh3d4iId4h3iIh3d4+HD4eIh3eIiId3eIiId3ePdwD3iIh3eIiP+PiIh3d4+H8A/3iId3eIiIiIh3d3j4fwAA+HiIh3d3iIh3d3ePh3AAAA93j4h3d3d3d3eI+HfwAAAA+Hj/iId3d3iI/4d/AAAAAA/3eP//iIj//4d/8AAAAAAA/4d4iP//+Id38AAAAAAAAAD/93d3d3d4/wAAAAD/wAP//gAA//wAAD/wAAAf4AAAD8AAAAfAAAADgAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAGAAAABgAAAA8AAAAfgAAAH8AAAD/gAAB/8AAB//wAA/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791298751277,"unified_at":"2026-10-06T14:59:11.277Z","metadata":{"hashes":{"sha256":"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f","sha1":"20e384313836ee49f6a3af1ab38eef9c3866f16a","md5":"bd2ae8f5242fbeca5a26c03d66047775","sha512":"c50be20ba8f8a2e2b6b84f6d8a8a4df61502f66646772d73fff040d0601c6327c0abe2ff563c323dabc8d46885fc3ddee510f4525f820e76709401d6f5199d21","ssdeep":"12288:hhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcxoLiTdl:vRmJkcoQricOIQxiZY1aoLiTdl","ssdeep_chunks":["12288:hhkDgou","12288:hkDgouV","12288:kDgouVA","12288:DgouVA2","12288:gouVA2n","12288:ouVA2nx","12288:uVA2nxK","12288:VA2nxKk","12288:A2nxKko","12288:2nxKkor","12288:nxKkorv","12288:xKkorvd","12288:KkorvdR","12288:korvdRg","12288:orvdRgQ","12288:rvdRgQr","12288:vdRgQri","12288:dRgQriD","12288:RgQriDw","12288:gQriDwO","12288:QriDwOI","12288:riDwOIx","12288:iDwOIxm","12288:DwOIxmx","12288:wOIxmxi","12288:OIxmxiZ","12288:IxmxiZn","12288:xmxiZnY","12288:mxiZnYQ","12288:xiZnYQE","12288:iZnYQE7","12288:ZnYQE7P","12288:nYQE7PJ","12288:YQE7PJc","12288:QE7PJcx","12288:E7PJcxo","12288:7PJcxoL","12288:PJcxoLi","12288:JcxoLiT","12288:cxoLiTd","12288:xoLiTdl","24576:hhkDgou","24576:hkDgouV","24576:kDgouVA","24576:DgouVA2","24576:gouVA2n","24576:ouVA2nx","24576:uVA2nxK","24576:VA2nxKk","24576:A2nxKko","24576:2nxKkor","24576:nxKkorv","24576:xKkorvd","24576:KkorvdR","24576:korvdRg","24576:orvdRgQ","24576:rvdRgQr","24576:vdRgQri","24576:dRgQriD","24576:RgQriDw","24576:gQriDwO","24576:QriDwOI","24576:riDwOIx","24576:iDwOIxm","24576:DwOIxmx","24576:wOIxmxi","24576:OIxmxiZ","24576:IxmxiZn","24576:xmxiZnY","24576:mxiZnYQ","24576:xiZnYQE","24576:iZnYQE7","24576:ZnYQE7P","24576:nYQE7PJ","24576:YQE7PJc","24576:QE7PJcx","24576:E7PJcxo","24576:7PJcxoL","24576:PJcxoLi","24576:JcxoLiT","24576:cxoLiTd","24576:xoLiTdl","12288:vRmJkco","12288:RmJkcoQ","12288:mJkcoQr","12288:JkcoQri","12288:kcoQric","12288:coQricO","12288:oQricOI","12288:QricOIQ","12288:ricOIQx","12288:icOIQxi","12288:cOIQxiZ","12288:OIQxiZY","12288:IQxiZY1","12288:QxiZY1a","12288:xiZY1ao","12288:iZY1aoL","12288:ZY1aoLi","12288:Y1aoLiT","12288:1aoLiTd","12288:aoLiTdl"],"imphash":"f05e77d02215199128bfedb2cd329b78"},"file_info":{"file_name":"20e384313836ee49f6a3af1ab38eef9c3866f16a.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":794501,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1681763110000,"last_seen":1681763111000,"last_multi_scan":1681763111000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["multiple","pistolar","evasive"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":58},"sandbox_signatures":{"informative_count":114,"suspicious_count":14,"malicious_count":6,"total":134},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Virus/Win32.Expiro.imp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1321488","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Generic-9951773-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Packed.Win32.MUPX.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"malicious","value":"Contains native function calls"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"Contains ability to start/interact with device drivers"},{"type":"informative","value":"Contains ability to start/interact with device drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to update the user profile (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Scans for the windows taskbar (may be used for explorer injection)"},{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to write data into process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the cryptographic module DLL"},{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry value (API string)"},{"type":"informative","value":"Contains ability to create/open registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBinW API"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"suspicious","value":"Contains ability to remove directories"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to read registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate processes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains the ability to enumerate system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Contains ability to download files from the internet"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Observed string: \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Observed string: \"\" (Indicator: \"CallWindowProc\") in Source: 00000000-00004868.00000000.79923.03AA0000.00000004.mdmp\n 00000000-00004868.00000001.81841.03AA0000.00000004.mdmp\n 00000000-00004868.00000002.83763.03AA0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Observed string: \"SetFileTime\" (Indicator: \"SetFileTime\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"SetFileTime\" (Indicator: \"SetFileTime\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write data into process memory (API string)","description":"Observed string: \"WriteProcessMemory\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"WriteProcessMemory\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Observed string:\"OutputDebugString\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string:\"IsDebuggerPresent\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed string: \"UnhandledExceptionFilter\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"SetUnhandledExceptionFilter\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004868-59440-12-0041A208\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004868-59440-33-00417DAA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00004868)\n \".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004868)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00004868-59440-834-0041F5DC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00004868-59440-762-004339B6\n FindFirstFileW@KERNEL32.DLL at 00000000-00004868-59440-1575-0044BD27\n FindFirstFileW@KERNEL32.DLL at 00000000-00004868-59440-1576-0044BF8B\n FindFirstFileW@KERNEL32.DLL at 00000000-00004868-59440-1628-00452492\n FindNextFileW@KERNEL32.DLL at 00000000-00004868-59440-1422-00442886\n FindNextFileW@KERNEL32.DLL at 00000000-00004868-59440-1201-00431A86","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found string \"FindWindowExW\" (Indicator: \"FindWindowExW\"; in File: \"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\")\n Found string \"FindWindowW\" (Indicator: \"FindWindowW\"; in File: \"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004868-59440-412-004148B3\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004868-59440-834-0041F5DC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00004868-59440-1222-00432A10\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004868-59440-412-004148B3\n GetLocalTime@KERNEL32.DLL at 00000000-00004868-59440-345-004720DB\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004868-59440-834-0041F5DC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00004868-59440-355-0041E364","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00004868-59440-948-0040E500","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set cd door\" (Indicator: \"set \"; File: \"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\")\n Found string \"set cd door\" (Indicator: \"set \"; Source: \"00000000-00004868.00000000.79923.00483000.00000080.mdmp, 00000000-00004868.00000001.81841.00483000.00000080.mdmp, 00000000-00004868.00000002.83763.00483000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Observed string: \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Observed string: \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardLayoutNameW@USER32.DLL at 00000000-00004868-59440-345-004720DB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed string: \"GetVersionExW \" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"GetVersionExW \" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string: \"GetStartupInfo\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Observed string: \"GetVolumeInformation\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"GetVolumeInformation\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp word ptr [esi], 0000h\" and \"je 00432B89h\" at 00000000-00004868-59440-1222-00432A10\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, edi\" and \"je 0041E55Dh\" at 00000000-00004868-59440-355-0041E364","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00004868-59440-1353-00436B91\n GetProcessHeap@KERNEL32.DLL at 00000000-00004868-59440-1354-00436BA9\n GetProcessHeap@KERNEL32.DLL at 00000000-00004868-59440-1358-00436B19\n GetProcessHeap@KERNEL32.DLL at 00000000-00004868-59440-708-004238DA","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\".exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00004868)\n \".exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00004868)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Observed string: \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Observed string: \"IcmpCreateFile\" (Indicator: \"CreateFile\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"IcmpCreateFile\" (Indicator: \"CreateFile\") in Source: 00000000-00004868.00000000.79923.00483000.00000080.mdmp\n 00000000-00004868.00000001.81841.00483000.00000080.mdmp\n 00000000-00004868.00000002.83763.00483000.00000080.mdmp\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00004868-59440-1351-00436A0B\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-611-004091B0\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-218-0045178A\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-1258-00434582\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-998-0045FD57\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-1447-00443B61\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-971-0040D3B0\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-43-00416B04\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-223-00453BC6\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-26-00416B49\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-73-00416B95\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-89-004091E0\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-332-004331A2\n Sleep@KERNEL32.DLL at 00000000-00004868-59440-383-00416BE3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00004868-59440-1170-00430E7B\n LoadLibraryA@KERNEL32.DLL at 00000000-00004868-59440-810-0040EBD0\n LoadLibraryA@KERNEL32.DLL at 00000000-00004868-59440-1177-004312CC\n LoadLibraryA@KERNEL32.DLL at 00000000-00004868-59440-418-00430DC1\n LoadLibraryW@KERNEL32.DLL at 00000000-00004868-59440-1696-0045774C\n LoadLibraryA@KERNEL32.DLL at 00000000-00004868-59440-1166-00430C7F\n LoadLibraryA@KERNEL32.DLL at 00000000-00004868-59440-1176-0043129A\n LoadLibraryW@KERNEL32.DLL at 00000000-00004868-59440-1380-00440C49\n LoadLibraryA@KERNEL32.DLL at 00000000-00004868-59440-951-0040EFD0\n LoadLibraryExW@KERNEL32.DLL at 00000000-00004868-59440-1656-00454E8D\n LoadLibraryW@KERNEL32.DLL at 00000000-00004868-59440-14-0042009C\n LoadLibraryA@KERNEL32.DLL at 00000000-00004868-59440-954-0040EF60\n LoadLibraryA@KERNEL32.DLL at 00000000-00004868-59440-1269-00434B02\n LoadLibraryA@KERNEL32.DLL at 00000000-00004868-59440-1178-004312FE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Observed string: \"MoveFileW\" (Indicator: \"MoveFile\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"MoveFileW\" (Indicator: \"MoveFile\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"UnregisterHotKey@USER32.DLL at 00000000-00004868-59440-900-00401CB0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Observed string: \"GetCommandLineW\" (Indicator: \"GetCommandLine\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"GetCommandLineW\" (Indicator: \"GetCommandLine\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains ability to start/interact with device drivers (API string)","description":"Observed string: \"DeviceIoControl\" (Indicator: \"DeviceIoControl\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"DeviceIoControl\" (Indicator: \"DeviceIoControl\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.006","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Observed string: \"SHFileOperationW\" (Indicator: \"SHFileOperation\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"SHFileOperationW\" (Indicator: \"SHFileOperation\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\AutoIt v3\\AutoIt\" in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n \"SOFTWARE\\Classes\\\" in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n \"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\" in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate system service (API string)","description":"Observed string: \"OpenSCManagerW\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"OpenSCManagerW\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"NTDLL.DLL\" at base 77d70000\n \".exe\" loaded module \"COMCTL32.DLL\" at base 73640000\n \".exe\" loaded module \"COMCTL32\" at base 73640000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76780000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77CB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\" has an executable section named \"UPX0\"\n \"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\" has an writable section named \"UPX0\"\n \"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\" has an writable section named \"UPX1\"\n \"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\" has an writable section named \".rsrc\"\n \"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\" has an writable section named \".imports\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\" file has an entrypoint instructions - \"call\t0x41f5dc,jmp\t0x416454,int3\t,int3\t,int3\t,int3\t,int3\t,push\tebp,mov\tebp, esp,push\tedi,push\tesi,mov\tesi, dword ptr [ebp + 0xc],mov\tecx, dword ptr [ebp + 0x10],mov\tedi, dword ptr [ebp + 8],mov\teax, ecx,mov\tedx, ecx,add\teax, esi,cmp\tedi, esi,jbe\t0x4165f0,cmp\tedi, eax,jb\t0x416790,cmp\tecx, 0x80,jb\t0x416614,cmp\tdword ptr [0x4a9724], 0,je\t0x416614,push\tedi,push\tesi,and\tedi, 0xf,and\tesi, 0xf,cmp\tedi, esi,pop\tesi,pop\tedi,jne\t0x416614,jmp\t0x4169f1,test\tedi, 3,jne\t0x416630,shr\tecx, 2,and\tedx, 3,cmp\tecx, 8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\".exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00004868-59440-345-004720DB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\CBB36FBFCD50F2C2815F2031DC3B77AFF8D837D5DD9BB807F330394C7799168F.EXE.LOCAL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\UXTHEME.DLL.CONFIG\"\n \".exe\" trying to access non-existent file \"C:\\cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Observed string: \"InternetConnectW\" (Indicator: \"InternetConnect\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"InternetConnectW\" (Indicator: \"InternetConnect\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Observed string: \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Observed string: \"CreatePipe\" (Indicator: \"CreatePipe\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"CreatePipe\" (Indicator: \"CreatePipe\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Observed string: \"WNetCancelConnection2W\" which can cancels an existing network connection. [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"WNetUseConnectionW\" which can makes a connection to a network resource. [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Observed string: \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"\n Heuristic match: \"et@.et\"\n Heuristic match: \"u0g'uP.lu\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetAddConnection\" which can \"makes a connection to a network resource\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed import api \"WNetCancelConnection\" which can \"cancels an existing network connection\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed import api \"WNetUseConnection\" which can \"makes a connection to a network resource\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00004868\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Observed string: \"SHEmptyRecycleBinW\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"SHEmptyRecycleBinW\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed string: \"SystemParametersInfoW\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"SystemParametersInfoW\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBinW API","description":"Observed import api \"SHEmptyRecycleBinW\" which can \"Empties the Recycle Bin on the specified drive\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Observed string: \"GetClipboardData\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"OpenClipboard\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"GetClipboardData\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]\n Observed string: \"OpenClipboard\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed string: \"GetDriveTypeW\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"GetDriveTypeW\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string: \"FindFirstFileW\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"FindNextFileW\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"FindFirstFileW\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]\n Observed string: \"FindNextFileW\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-534","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Observed interface string:\"InterlockedExchange\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed interface string:\"InterlockedExchange\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed string: \"GetComputerNameW\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"GetComputerNameW\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string: \"GetModuleFileName\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"GetModuleFileName\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed string: \"GetEnvironmentVariableW\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"GetEnvironmentVariableW\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed string: \"GetSystemMetrics\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"GetSystemMetrics\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames (API string)","description":"Observed string: \"GetUserNameW\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"GetUserNameW\" [Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Observed string: \"CreateProcessAsUserW\" [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files (API string)","description":"Observed string: \"DeleteFileW\" (Indicator: \"DeleteFile\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFile\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00004868.00000000.79923.00483000.00000080.mdmp\n 00000000-00004868.00000001.81841.00483000.00000080.mdmp\n 00000000-00004868.00000002.83763.00483000.00000080.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed string: \"DSeAssignPrimaryTokenPrivilege\" which can Replace a process level token. [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"SeIncreaseQuotaPrivilege\" which can Adjust memory quotas for a process. [Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin]\n Observed string: \"SeAssignPrimaryTokenPrivilege\" which can Replace a process level token. [Source: 50430-1952-00436F47]\n Observed string: \"SeAssignPrimaryTokenPrivilege\" which can Replace a process level token. [Source: 00000000-00004868.00000000.79923.00483000.00000080.mdmp\n 00000000-00004868.00000001.81841.00483000.00000080.mdmp\n 00000000-00004868.00000002.83763.00483000.00000080.mdmp]\n Observed string: \"SeIncreaseQuotaPrivilege\" which can Adjust memory quotas for a process. [Source: 00000000-00004868.00000000.79923.00483000.00000080.mdmp\n 00000000-00004868.00000001.81841.00483000.00000080.mdmp\n 00000000-00004868.00000002.83763.00483000.00000080.mdmp]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Observed string: \"WriteFile\" (Indicator: \"WriteFile\") in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n Observed string: \"WriteFile\" (Indicator: \"WriteFile\") in Source: 00000000-00004868.00000000.79923.004AB000.00000080.mdmp\n 00000000-00004868.00000000.79923.004C2000.00000004.mdmp\n 00000000-00004868.00000001.81841.004AB000.00000080.mdmp\n 00000000-00004868.00000001.81841.004C2000.00000004.mdmp\n 00000000-00004868.00000002.83763.004AB000.00000080.mdmp\n 00000000-00004868.00000002.83763.004C2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-535","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$41","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\" has a section named \"UPX0\"\n \"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"$43","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"35/70 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00004868-59440-1227-0043305F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00000000-00004868-59440-1413-004422FE\n InternetReadFile@WININET.DLL at 00000000-00004868-59440-1414-004423DA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1105","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\n \"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00004868.00000000.79923.00483000.00000080.mdmp\n 00000000-00004868.00000000.79923.05270000.00000002.mdmp\n 00000000-00004868.00000001.81841.00483000.00000080.mdmp\n 00000000-00004868.00000001.81841.05270000.00000002.mdmp\n 00000000-00004868.00000002.83763.00483000.00000080.mdmp\n 00000000-00004868.00000002.83763.05270000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\".exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1055.011","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n \"255.255.255.255\"\n \"5.255.255.255\"\n Potential IP \"5.1.0.0\" found in string \"Microsoft.Windows.Shell.shell32,processorArchitecture=\"*\",type=\"win32\",version=\"5.1.0.0\"C:\\WINDOWS\\WindowsShell.Manifest\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00004868-59440-47-0040D6B0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004868.00000000.79923.03AA0000.00000004.mdmp, 00000000-00004868.00000001.81841.03AA0000.00000004.mdmp, 00000000-00004868.00000002.83763.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@KERNEL32.DLL at 00000000-00004868-59440-1573-0044BB30\n RemoveDirectoryW@KERNEL32.DLL at 00000000-00004868-59440-1202-00431BE8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.bin\" has an entrypoint in section \"UPX0\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$44","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$45","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"35/70 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00000000-00004868-59440-1202-00431BE8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00004868-59440-1231-004333BE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"$46","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":52,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["multiple","pistolar","evasive"],"sandbox_reports":[{"id":"643dc927960f4ba1e30587d6","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Autoit","submit_name":"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.exe","analysis_start_time":"2023-04-17T22:33:11+00:00","indicators_count":{"informative":114,"suspicious":48,"malicious":6},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"643dc927960f4ba1e30587d6"}],"processes":[{"pid":4868,"ppid":0,"name":"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.exe","command_line":"","sha256":"cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f","normalized_path":"C:\\cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f.exe","uid":"00000000-00004868","icon":"$47"}],"all_imported_dlls":["wow64cpu.dll","KernelBase.dll","comdlg32.dll","gdi32.dll","powrprof.dll","version.dll","imm32.dll","cldapi.dll","cryptbase.dll","bcryptprimitives.dll","gdi32full.dll","kernel.appcore.dll","winmm.dll","fltLib.dll","cryptsp.dll","msctf.dll","wow64win.dll","msvcrt.dll","sechost.dll","shlwapi.dll","userenv.dll","aepic.dll","ntmarta.dll","dwmapi.dll","ntdll.dll","kernel32.dll","sspicli.dll","comctl32.dll","combase.dll","ucrtbase.dll","msvcp_win.dll","oleaut32.dll","wow64.dll","win32u.dll","cfgmgr32.dll","profapi.dll","psapi.dll","wsock32.dll","winmmbase.dll","ws2_32.dll","user32.dll","shell32.dll","ole32.dll","apphelp.dll","SHCore.dll","wininet.dll","bcrypt.dll","windows.storage.dll","advapi32.dll","rpcrt4.dll","mpr.dll","uxtheme.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["643dc927960f4ba1e30587d6"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample cbb36fbfcd50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cbb36fbfcd50…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 7/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample cbb36fbfcd50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cbb36fbfcd50…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 7/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample cbb36fbfcd50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cbb36fbfcd50…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 7/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]]