34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 6e:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4d1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dacic.9551.Generic Sample ce3d4a6aca8b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ce3d4a6aca8b…. Malware family: Dacic.9551.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 10 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23","keywords":["Malicious","Dacic.9551.Generic","malware analysis","sandbox report","threat intelligence","ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23"],"about":{"@type":"SoftwareApplication","name":"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin","applicationCategory":["peexe","executable"],"identifier":"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dacic.9551.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Tca2,Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp")37:T89a,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp")38:T592,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp")39:Ta04,"" (Indicator: "GetDC"; Source: "00000000-00005752.00000000.130223.02930000.00000004.mdmp, 00000000-00005752.00000001.132145.02930000.00000004.mdmp, 00000000-00005752.00000002.134065.02930000.00000004.mdmp, 00000000-00005752.00000003.139438.02930000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005752.00000000.130223.02930000.00000004.mdmp, 00000000-00005752.00000001.132145.02930000.00000004.mdmp, 00000000-00005752.00000002.134065.02930000.00000004.mdmp, 00000000-00005752.00000003.139438.02930000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005752.00000000.130223.02930000.00000004.mdmp, 00000000-00005752.00000001.132145.02930000.00000004.mdmp, 00000000-00005752.00000002.134065.02930000.00000004.mdmp, 00000000-00005752.00000003.139438.02930000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005752.00000000.130223.02930000.00000004.mdmp, 00000000-00005752.00000001.132145.02930000.00000004.mdmp, 00000000-00005752.00000002.134065.02930000.00000004.mdmp, 00000000-00005752.00000003.139438.02930000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005752.00000000.130223.02930000.00000004.mdmp, 00000000-00005752.00000001.132145.02930000.00000004.mdmp, 00000000-00005752.00000002.134065.02930000.00000004.mdmp, 00000000-00005752.00000003.139438.02930000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005752.00000000.130223.02930000.00000004.mdmp, 00000000-00005752.00000001.132145.02930000.00000004.mdmp, 00000000-00005752.00000002.134065.02930000.00000004.mdmp, 00000000-00005752.00000003.139438.02930000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005752.00000000.130223.02930000.00000004.mdmp, 00000000-00005752.00000001.132145.02930000.00000004.mdmp, 00000000-00005752.00000002.134065.02930000.00000004.mdmp, 00000000-00005752.00000003.139438.02930000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005752.00000000.130223.02930000.00000004.mdmp, 00000000-00005752.00000001.132145.02930000.00000004.mdmp, 00000000-00005752.00000002.134065.02930000.00000004.mdmp, 00000000-00005752.00000003.139438.02930000.00000004.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006020.00000000.130094.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006020.00000000.130094.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006020.00000000.130094.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006020.00000000.130094.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006020.00000000.130094.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006020.00000000.130094.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006020.00000000.130094.02DF0000.00000004.mdmp")61:T590,Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp")62:Tbd2,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp")63:T81a,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp")64:T4c2,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp")65:Tc37,Found string "[Tab]" (Indicator: "[tab]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[Alt]" (Indicator: "[alt]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[Alt]" (Indicator: "[Alt]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[Pause]" (Indicator: "[pause]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[Esc]" (Indicator: "[esc]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[End]" (Indicator: "[end]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[Left]" (Indicator: "[left]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[Right]" (Indicator: "[right]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[Down]" (Indicator: "[down]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[F10]" (Indicator: "[F10]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[F11]" (Indicator: "[F11]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[F12]" (Indicator: "[F12]"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found string "[Tab]" (Indicator: "[tab]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[Alt]" (Indicator: "[alt]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[Alt]" (Indicator: "[Alt]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[Pause]" (Indicator: "[pause]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[Esc]" (Indicator: "[esc]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[End]" (Indicator: "[end]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[Left]" (Indicator: "[left]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[Right]" (Indicator: "[right]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[Down]" (Indicator: "[down]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp")66:T7ea,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "fso.DeleteFile "" (Indicator: "DeleteFile"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin"), Found reference to API "fso.DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin"), Found reference to API "CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin"), Found reference to API "").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin") Found reference to API "fso.DeleteFile "" (Indicator: "DeleteFile"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp"), Found reference to API "fso.DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp"), Found reference to API "CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp"), Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp"), Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp"), Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005752.00000003.139438.0045F000.00000002.mdmp")67:Ta9b,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005752.00000000.130223.02930000.00000004.mdmp, 00000000-00005752.00000001.132145.02930000.00000004.mdmp, 00000000-00005752.00000002.134065.02930000.00000004.mdmp, 00000000-00005752.00000003.139438.02930000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006020.00000000.130094.02DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$39","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 41577-4005-0043B65F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005752-43674-49-0044238D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005752-43674-1604-0043BAF8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005752-43674-2291-0043B4CC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005752-43674-3440-0043B65F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API CreateThreadpoolWait@KERNEL32.DLL at 00000000-00005752-43674-2976-0043CAFD\n Found reference to API FlsAlloc@KERNEL32.DLL at 00000000-00005752-43674-3302-0043CA0D\n Found reference to API GetCursorInfo@USER32.DLL at 00000000-00005752-43674-3429-0040145C\n Found reference to API GetLastInputInfo@USER32.DLL at 00000000-00005752-43674-3434-0040151B","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$3c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Possibly contains Public/Private key (encryption)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Able to use RSA keys for encryption and decryption\n Matched sigs: Uses Windows cryptography API for obfuscation\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains key cryptographic functions of the CryptoAPI\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")\n Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00006020.00000000.130094.04DD0000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00006020.00000000.130094.04DD0000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00006020.00000000.130094.04DD0000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00006020.00000000.130094.04FC0000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00006020.00000000.130094.04FC0000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00006020.00000000.130094.04FC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found string \"EnumServicesStatusW\" (File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found string \"QueryServiceConfigW\" (File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found string \"EnumServicesStatusW\" (Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found string \"\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutNameA\" (Indicator: \"GetKeyboardLayout\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayoutNameA\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"ce3d4a6aca8b7fc6e921fd16c0db7b6eb080cea524fa8df7d7b69104d62e5c23.bin\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005752.00000000.130223.02930000.00000004.mdmp, 00000000-00005752.00000001.132145.02930000.00000004.mdmp, 00000000-00005752.00000002.134065.02930000.00000004.mdmp, 00000000-00005752.00000003.139438.02930000.00000004.mdmp\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00005752.00000003.139438.0045F000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006020.00000000.130094.02DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"sysconfig.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"sysconfig.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005752)\n \"sysconfig.exe\" called \"GetComputerNameExW\" with parameters (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\" Microsoft Corporation\"\n \"sysconfig.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6998bcae6f31a8ac670b1b87"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"