26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T477,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample cead013e2c3a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cead013e2c3a…. Malware family: Zusy.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T75a,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000035db7889a3830d72f802dc00687d7677a0f2dc0040b10d72f954abfbfeffffffbcf1dc0002720c7260f1dc000000187658f2dc001b720c72e0df527708000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000e8f1dc0000000000080000000000000000000000000000000000000000000000000018765ddb78890000000028f2dc006992a075ffffffff34000000e8f1dc0008000000000000000000187658f2dc002794a075f0f1dc000b0000000000000040f2dc00 (UID: 00000000-00007724) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007724) "file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007724)28:T132f,"file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007724) "file.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00007724)29:T443,"file.exe" loaded module "KERNEL32" at base 754e0000 "file.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75900000 "file.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75900000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75900000 "file.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76050000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75900000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75900000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75900000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73700000 "file.exe" loaded module "USER32.DLL" at base 75360000 "file.exe" loaded module "ADVAPI32.DLL" at base 74c50000 "file.exe" loaded module "NTDLL.DLL" at base 77ab0000 "file.exe" loaded module "WINMM.DLL" at base 73630000 "file.exe" loaded module "NTDLL" at base 77ab0000 "file.exe" loaded module "KERNEL32.DLL" at base 754e0000 "file.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 754e00002a:T7e1,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2b:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007724.00000000.128409.03190000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007724.00000000.128409.03190000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007724.00000000.128409.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007724.00000000.128409.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007724.00000000.128409.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007724.00000000.128409.03190000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007724.00000000.128409.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007724.00000000.128409.03190000.00000004.mdmp")2c:T2f93,Found XOR loop in file "sample.bin" at offset 18881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 203343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 236717; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 318636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 328684; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 674029; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 695044; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 798946; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 860662; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 869962; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1083056; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1085291; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1094358; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1109229; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1113611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1132477; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1190926; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1191317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1198511; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1200291; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1226363; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1237243; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1237736; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1303858; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1309108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1337424; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1339288; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1352201; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1368927; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1378712; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1407985; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1410581; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1430181; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1471271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1520459; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1553416; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1557201; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1623763; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1625934; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1627319; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1682484; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1695610; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1772528; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1781273; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1788993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1798437; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1829364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1836644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1841801; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1843042; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1858935; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1862620; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1867358; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1872276; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1896475; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1902584; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 79758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 182099; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 219374; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 403033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 536826; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 681165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 691461; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 912984; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 941461; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1001276; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1185288; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1236677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1329107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1331225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1343085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1404963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1441356; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1544962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1634122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1686275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1760590; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1824047; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 89477; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 168894; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 218018; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 394955; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 476413; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 501728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 784411; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 829854; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 958358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1020066; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1037022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1039210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1048015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1053337; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1081157; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1086203; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1095651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1107828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1109441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1129284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1131896; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1153102; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1163472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1176868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1193098; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1234163; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1240064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1247358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1258229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1265572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1273741; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1285857; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1291321; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1292921; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1293586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1296767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1296858; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1321798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1327341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1351232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1385877; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1413482; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1419816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1420059; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1421718; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1433482; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1439884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1460906; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1492023; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1496463; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1509997; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1513383; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1514437; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1533735; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1546828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1559013; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1560942; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1567649; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1569983; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1570595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1576474; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1582278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1594642; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1605164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1626575; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1628331; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1637269; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1650756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1691832; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1695252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1706471; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1719047; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1726607; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1729829; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1735758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1745361; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1759480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1764781; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1768040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1774112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1785622; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1831676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1846146; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1856520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1894879; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1895665; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1905518; code bytes = 80302d:T499,"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe" searching for class "OLLYDBG" "cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe" searching for class "GBDYLLO" "cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe" searching for class "pediy06" "cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe" searching for class "FilemonClass" "cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe" searching for window "File Monitor - Sysinternals: www.sysinternals.com" "cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe" searching for class "PROCMON_WINDOW_CLASS" "cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe" searching for window "Process Monitor - Sysinternals: www.sysinternals.com" "cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe" searching for class "RegmonClass" "cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe" searching for window "Registry Monitor - Sysinternals: www.sysinternals.com" "cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe" searching for class "18467-41"2e:T492,Found string "\SystemRoot\system32\DRIVERS\vmci.sys" (Indicator: "\vmci"; File: "00000000-00004684.00000000.225590.00350000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vmmouse.sys" (Indicator: "vmmouse"; File: "00000000-00004684.00000000.225590.00350000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vmusbmouse.sys" (Indicator: "vmusb"; File: "00000000-00004684.00000000.225590.00350000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vmmemctl.sys" (Indicator: "vmmemctl"; File: "00000000-00004684.00000000.225590.00350000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vmci.sys" (Indicator: "\vmci"; Source: "00000000-00004684.00000000.225590.00350000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vmmouse.sys" (Indicator: "vmmouse"; Source: "00000000-00004684.00000000.225590.00350000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vmusbmouse.sys" (Indicator: "vmusb"; Source: "00000000-00004684.00000000.225590.00350000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vmmemctl.sys" (Indicator: "vmmemctl"; Source: "00000000-00004684.00000000.225590.00350000.00000004.mdmp")2f:Td13,Observed system executable string:"C:\Windows\SYSTEM32\wow64win.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"C:\Windows\SYSTEM32\wow64cpu.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\ntdll.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\apisetschema.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\imagehlp.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\usp10.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\normaliz.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\ws2_32.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\Wldap32.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\sechost.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\difxapi.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\msctf.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\kernel32.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\clbcatq.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\shlwapi.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\imm32.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\psapi.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\iertutil.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\comdlg32.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\oleaut32.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\msvcrt.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\lpk.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\user32.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\shell32.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp] Observed system executable string:"\Windows\System32\rpcrt4.dll" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp]30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A/3d4///4d2Zmd4///////4dmZn+HZmd3d3ZmeP////92ZmZnZnd3eHd3d2Z/////ZmZmZnd3d3d3d3h3Z4///2ZmZnd3d3d3d3d3d3Zo//9mZmZ3d3d3d3d3d3d3Zo//hmZmZ3d3d3d3d3d3d3Z///hmZmZ4d3d3d3d3d3eHZ//4ZmZmZ3d3d3d3d3d3d3aP92ZmZmZ3d3d3d3d3d3d2f/ZmZmZmZmZmZmZmd3d3d2+GZmZmZmZnd3d3d3d3d3dodmZmZmZmZ4d3eHd3d3d3Z3ZmZmZmZmZ3d3d3d3d3d3dmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmZ3d3d3d3d4dmZmZmZmZmZmZ3d3h3d3d3ZmZmZmZmZmZmZ3d3d3d3d2dmZmZmZmZmZmRnd3d3d3dnZmZmZmZmZmZmZ4d3d3d3aGZmZmZmZmZmZmZ4d3d3d29mZmZmZmZmZmZmZ3d3d3dvdmZmZmZmZmZmZmZ3d3d3b4ZmZmZmZmZmZmZmZ3d3d2/3ZmZmZmZmZmZmZmZ3d4dv/3ZmZmZmZmZmZmZmZ4eHb/+GZmZmZmZmZmZmZmZ4d2//+GZmZmZmZmZmZmZmZ3dv//+HZmZmZmZmZmZmZmZ3b////3ZmZmZmZmZmZmZmZm/////4dmZmZmZmZmZmZmZv//////+HdmZmZmZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A/3d4///4d2Zmd4///////4dmZn+HZmd3d3ZmeP////92ZmZnZnd3eHd3d2Z/////ZmZmZnd3d3d3d3h3Z4///2ZmZnd3d3d3d3d3d3Zo//9mZmZ3d3d3d3d3d3d3Zo//hmZmZ3d3d3d3d3d3d3Z///hmZmZ4d3d3d3d3d3eHZ//4ZmZmZ3d3d3d3d3d3d3aP92ZmZmZ3d3d3d3d3d3d2f/ZmZmZmZmZmZmZmd3d3d2+GZmZmZmZnd3d3d3d3d3dodmZmZmZmZ4d3eHd3d3d3Z3ZmZmZmZmZ3d3d3d3d3d3dmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmZ3d3d3d3d4dmZmZmZmZmZmZ3d3h3d3d3ZmZmZmZmZmZmZ3d3d3d3d2dmZmZmZmZmZmRnd3d3d3dnZmZmZmZmZmZmZ4d3d3d3aGZmZmZmZmZmZmZ4d3d3d29mZmZmZmZmZmZmZ3d3d3dvdmZmZmZmZmZmZmZ3d3d3b4ZmZmZmZmZmZmZmZ3d3d2/3ZmZmZmZmZmZmZmZ3d4dv/3ZmZmZmZmZmZmZmZ4eHb/+GZmZmZmZmZmZmZmZ4d2//+GZmZmZmZmZmZmZmZ3dv//+HZmZmZmZmZmZmZmZ3b////3ZmZmZmZmZmZmZmZm/////4dmZmZmZmZmZmZmZv//////+HdmZmZmZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790266118903,"unified_at":"2026-09-24T16:08:38.903Z","metadata":{"hashes":{"sha256":"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212","sha1":"137a9e351a0216710004634997c78be7a7c85217","md5":"b00fddad7146360a79dc9f44a551a845","sha512":"2e43566eeda5d000c3d6855d096a3f6033b3cbc583c7c83bd6afd3b3c767474a295e810b718a6cb97b2144ab75f2223c1ddd988ca8f2f893982e8d8621c7f85c","ssdeep":"49152:fxKU97chH58tVSEjYjZNj2tndzGj04OBrMUjo6/KTnpz813:MU9AoDYjZd23zG4rBrMU9KNzc3","ssdeep_chunks":["49152:fxKU97c","49152:xKU97ch","49152:KU97chH","49152:U97chH5","49152:97chH58","49152:7chH58t","49152:chH58tV","49152:hH58tVS","49152:H58tVSE","49152:58tVSEj","49152:8tVSEjY","49152:tVSEjYj","49152:VSEjYjZ","49152:SEjYjZN","49152:EjYjZNj","49152:jYjZNj2","49152:YjZNj2t","49152:jZNj2tn","49152:ZNj2tnd","49152:Nj2tndz","49152:j2tndzG","49152:2tndzGj","49152:tndzGj0","49152:ndzGj04","49152:dzGj04O","49152:zGj04OB","49152:Gj04OBr","49152:j04OBrM","49152:04OBrMU","49152:4OBrMUj","49152:OBrMUjo","49152:BrMUjo6","49152:rMUjo6/","49152:MUjo6/K","49152:Ujo6/KT","49152:jo6/KTn","49152:o6/KTnp","49152:6/KTnpz","49152:/KTnpz8","49152:KTnpz81","49152:Tnpz813","98304:fxKU97c","98304:xKU97ch","98304:KU97chH","98304:U97chH5","98304:97chH58","98304:7chH58t","98304:chH58tV","98304:hH58tVS","98304:H58tVSE","98304:58tVSEj","98304:8tVSEjY","98304:tVSEjYj","98304:VSEjYjZ","98304:SEjYjZN","98304:EjYjZNj","98304:jYjZNj2","98304:YjZNj2t","98304:jZNj2tn","98304:ZNj2tnd","98304:Nj2tndz","98304:j2tndzG","98304:2tndzGj","98304:tndzGj0","98304:ndzGj04","98304:dzGj04O","98304:zGj04OB","98304:Gj04OBr","98304:j04OBrM","98304:04OBrMU","98304:4OBrMUj","98304:OBrMUjo","98304:BrMUjo6","98304:rMUjo6/","98304:MUjo6/K","98304:Ujo6/KT","98304:jo6/KTn","98304:o6/KTnp","98304:6/KTnpz","98304:/KTnpz8","98304:KTnpz81","98304:Tnpz813","49152:MU9AoDY","49152:U9AoDYj","49152:9AoDYjZ","49152:AoDYjZd","49152:oDYjZd2","49152:DYjZd23","49152:YjZd23z","49152:jZd23zG","49152:Zd23zG4","49152:d23zG4r","49152:23zG4rB","49152:3zG4rBr","49152:zG4rBrM","49152:G4rBrMU","49152:4rBrMU9","49152:rBrMU9K","49152:BrMU9KN","49152:rMU9KNz","49152:MU9KNzc","49152:U9KNzc3"],"imphash":"2eabe9054cad5152567f0699947a2c5b"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1961472,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1733303351000,"last_seen":1789249348000,"last_multi_scan":1789249348000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":41},"sandbox_signatures":{"informative_count":69,"suspicious_count":14,"malicious_count":7,"total":90},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.AGEN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.Tepfer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"BDS/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.568852","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Zusy-10038513-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.568852 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.HZB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.038120A1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:TrojanSpy/Stealer.ay","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 005cdebc1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.CZZI-7493","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.XHD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Chapak.Win32.96067","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"},{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Queries process information"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains reference to Sysinternals URL"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.2.9\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"lstrcpy\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetCommandLineW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007724.00000000.128409.03190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"oCRC2<\" (Indicator: \"RC2\"; File: \"file\")\n Found reference to \"oCRC2<\" (Indicator: \"RC2\"; Source: \"00000000-00007724.00000000.128409.00ABC000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.931520369454481","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007724-00000C29-1008464566\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"file.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007724)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"file.exe\" called \"IsWow64Process\" with parameter \"7724\" - (UID: 00000000-00007724)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"file.exe\" called \"GetWindowTextA\" (UID: 00000000-00007724)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007724)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"file.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007724)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"file.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007724)\n \"file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007724)\n \"file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007724)\n \"file.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007724)\n \"file.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00007724)\n \"file.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00007724)\n \"file.exe\" called \"LoadLibrary\" with a parameter NTDLL.dll (UID: 00000000-00007724)\n \"file.exe\" called \"LoadLibrary\" with a parameter winmm.dll (UID: 00000000-00007724)\n \"file.exe\" called \"LoadLibrary\" with a parameter NTDLL (UID: 00000000-00007724)\n \"file.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00007724)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"ss Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00007724.00000000.128409.03190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 779F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77920000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"file\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file\" has an executable section named \"\"\n \"file\" has an executable section named \"rmqoydsv\"\n \"file\" has an executable section named \"brqyawhr\"\n \"file\" has an executable section named \".taggant\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file\" has an writable section named \"\"\n \"file\" has an writable section named \".rsrc\"\n \"file\" has an writable section named \".idata\"\n \"file\" has an writable section named \"rmqoydsv\"\n \"file\" has an writable section named \"brqyawhr\"\n \"file\" has an writable section named \".taggant\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"file\" file has an entrypoint instructions - \"jmp\t0xc6b00a,bswap\tesp,sbb\teax, 0,add\tcl, ch,add\tbyte ptr [eax], ah,add\tbyte ptr [eax], al,add\tbyte ptr [0xa], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], dh,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,or\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax + eax*4], cl,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,adc\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\teax, 0xa,add\tbyte ptr [eax], al,add\tbyte ptr [eax], dl,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [esi], al,or\tal, byte ptr [eax],add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [edi], al,add\tbyte ptr [eax], 0,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"rmqoydsv\" is \"0x1ae800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x40d000\" greater than 0x100000\n Virtual size of \"\" is \"0x29a000\" greater than 0x100000\n Virtual size of \"rmqoydsv\" is \"0x1af000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 452 -p 7724 -ip 7724\" (UID: 00000000-00007448)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7724 -s 592\" (UID: 00000000-00008136)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7724 -s 592\" (UID: 00000000-00005588)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 452 -p 7724 -ip 7724\" (UID: 00000000-00007448)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7724 -s 592\" (UID: 00000000-00008136)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7724 -s 592\" (UID: 00000000-00005588)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"file\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"\"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 7724)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"file.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"file.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\file.exe\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"file.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"file.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMM.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\winmm.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMMBASE.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMMBASE.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"1:.re\"\n Heuristic match: \"\\h.ma\"\n Heuristic match: \"qb.er\"\n Heuristic match: \"q/.kw\"\n Heuristic match: \"~{v.ke\"\n Heuristic match: \"ns.lc\"\n Heuristic match: \"d$m.by\"\n Heuristic match: \"-q.mx\"\n Pattern match: \"www.sysinternals.com\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"file.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007724.00000000.128409.03190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"file.exe\" queried SystemProcessInformation at 00000000-00007724-00000C13-1007426167 [PID: 7724]\n \"file.exe\" queried SystemProcessInformation at 00000000-00007724-00000C13-1007434846 [PID: 7724]\n \"file.exe\" queried SystemProcessInformation at 00000000-00007724-00000C13-1007699816 [PID: 7724]\n \"file.exe\" queried SystemProcessInformation at 00000000-00007724-00000C13-1007712255 [PID: 7724]\n \"file.exe\" queried SystemProcessInformation at 00000000-00007724-00000C13-1008450483 [PID: 7724]\n \"file.exe\" queried SystemProcessInformation at 00000000-00007724-00000C13-1008460028 [PID: 7724]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"file\" has section name with entropy \"7.93237815909\"\n \"file\" has section name .rsrc with entropy \"7.87699895286\"\n \"file\" has section name rmqoydsv with entropy \"7.93763461785\"\n \"file\" has section name brqyawhr with entropy \"6.34173666936\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"file\" has resource with unusual entropy \"RT_CURSOR:7.27683907929\"\n \"file\" has resource with unusual entropy \"RT_CURSOR:7.97923719108\"\n \"file\" has resource with unusual entropy \"RT_STRING:7.68279169184\"\n \"file\" has resource with unusual entropy \"RT_STRING:7.67750813232\"\n \"file\" has resource with unusual entropy \"RT_STRING:7.72893621996\"\n \"file\" has resource with unusual entropy \"RT_STRING:7.79540677896\"\n \"file\" has resource with unusual entropy \"RT_STRING:7.80626028462\"\n \"file\" has resource with unusual entropy \"RT_STRING:7.78944322713\"\n \"file\" has resource with unusual entropy \"RT_STRING:7.79820857825\"\n \"file\" has resource with unusual entropy \"RT_STRING:7.77114167441\"\n \"file\" has resource with unusual entropy \"RT_STRING:7.79799776124\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"file.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00007724)\n \"file.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00007724)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"file\" claimed CRC 1964190 while the actual is CRC 2013694","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"file\" has an entrypoint in section \".taggant\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00005776]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005852-00000C2C-186778879\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005852)\n \"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00005852)\n \"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00005852)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005852)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00005852.00000000.75982.0080E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f4f476@RPCRT4.dll\"\n \"1800190068e8ce70@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e8ce70@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5fce70@ntdll.dll\"\n \"150016002073d570@ADVAPI32.dll\"\n \"0e000f00e473d570@ADVAPI32.dll\"\n \"0e000f005074d570@ADVAPI32.dll\"\n \"11001200d47dd570@ADVAPI32.dll\"\n \"110012007c7ed570@ADVAPI32.dll\"\n \"12001300cc7ed570@ADVAPI32.dll\"\n \"12001300387fd570@ADVAPI32.dll\"\n \"14001500e4b7d570@ADVAPI32.dll\"\n \"1400150000b8d570@ADVAPI32.dll\"\n \"140015001cb8d570@ADVAPI32.dll\"\n \"1700180038b8d570@ADVAPI32.dll\"\n \"0d000e0054b8d570@ADVAPI32.dll\"\n \"1100120064b8d570@ADVAPI32.dll\"\n \"110012007cb8d570@ADVAPI32.dll\"\n \"0f001000ecb9d570@ADVAPI32.dll\"\n \"1400150038bad570@ADVAPI32.dll\"\n \"1400150054bad570@ADVAPI32.dll\"\n \"0c000d00a8bad570@ADVAPI32.dll\"\n \"0c000d00b8bad570@ADVAPI32.dll\"\n \"0e000f00c8bad570@ADVAPI32.dll\"\n \"0e000f00dcbad570@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"$2d","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetCommandLineW\" (Source: cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212\" has section name with entropy \"7.932378159085946\"\n \"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212\" has section name .rsrc with entropy \"7.876998952862594\"\n \"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212\" has section name rmqoydsv with entropy \"7.93763461784702\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe\" is setting \"ThreadHideFromDebugger\" data for thread ID 0xfffffffe","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212.exe queries ProcessDebugPort (UID: 5852)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; File: \"00000000-00004684.00000000.225590.00350000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; File: \"00000000-00004684.00000000.225590.00350000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00004684.00000000.225590.00350000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00004684.00000000.225590.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"\\SystemRoot\\system32\\DRIVERS\\vmci.sys\" (Indicator: \"\\vmci\"; File: \"00000000-00004684.00000000.225590.00350000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00004684.00000000.225590.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Windows\\System32\\smss.exe\" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp]\n Observed system executable string:\"\\Windows\\System32\\autochk.exe\" [Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"file.exe\" trying to access non-existent file \"SICE\"\n \"file.exe\" trying to access non-existent file \"SIWVID\"\n \"file.exe\" trying to access non-existent file \"NTICE\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"csrss.exe,wininit.exe,lsass.exe,lsm.exe,svchost.exe\" (File: \"00000000-00004684.00000000.225590.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"00000000-00004684.00000000.225590.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"file.exe\" (Thread ID: 4380) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in File: \"00000000-00004684.00000000.225590.00350000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004684.00000000.225590.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"\\SystemRoot\\system32\\drivers\\luafv.sys\" (Indicator: \"luafv\") in Source: 00000000-00004684.00000000.225590.00350000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]}],"intel_graph":{"map":{"File:cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212":{"type":"File","value":"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus"]}}},"chains":[{"id":"1548448747191939029","root":"File:cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus"]}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":55,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Sample Crashed"],"sandbox_reports":[{"id":"6aa5c7431a1ea0860e0e07a9","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","submit_name":"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212","analysis_start_time":"2026-09-12T21:42:28+00:00","indicators_count":{"informative":50,"suspicious":13,"malicious":4},"tags":["Sample Crashed"],"is_in_unified_schema":true},{"id":"67501c72ba4e44c84d0f4a67","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"submit_name":"file","analysis_start_time":"2024-12-04T09:10:10+00:00","indicators_count":{"informative":52,"suspicious":16,"malicious":3},"is_in_unified_schema":true},{"id":"67501c36ec76caf5f2051e60","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"submit_name":"file","analysis_start_time":"2024-12-04T09:09:11+00:00","indicators_count":{"informative":51,"suspicious":13,"malicious":2},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"}],"processes":[{"pid":7724,"ppid":0,"name":"file.exe","command_line":"","sha256":"cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212","normalized_path":"C:\\file.exe","uid":"00000000-00007724","icon":"$30"},{"pid":8136,"ppid":7724,"name":"WerFault.exe","command_line":"-u -p 7724 -s 592","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007724","uid":"00000000-00008136"},{"pid":5588,"ppid":7724,"name":"WerFault.exe","command_line":"-u -p 7724 -s 592","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007724","uid":"00000000-00005588"},{"pid":7448,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 7724 -ip 7724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007448","icon":"$31"}],"all_imported_dlls":["user32.dll","combase.dll","winmm.dll","wow64.dll","kernel32.dll","rpcrt4.dll","sspicli.dll","bcryptprimitives.dll","gdi32.dll","fltLib.dll","wow64cpu.dll","VxSSL32.dll","win32u.dll","gdi32full.dll","wow64win.dll","ws2_32.dll","sechost.dll","ucrtbase.dll","advapi32.dll","msvcrt.dll","ntdll.dll","KernelBase.dll","apphelp.dll","msvcp_win.dll","ole32.dll","oleaut32.dll","cryptsp.dll","winmmbase.dll","cryptbase.dll","imm32.dll","cfgmgr32.dll","shlwapi.dll","nsi.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","vcruntime140.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-string-l1-1-0.dll","msctf.dll","usp10.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-time-l1-1-0.dll","msvcp140.dll","api-ms-win-core-processthreads-l1-1-1.dll","lpk.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"67501c36ec76caf5f2051e60"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aa5c7431a1ea0860e0e07a9"},{"report_type":"sandbox","report_id":"67501c72ba4e44c84d0f4a67"}]}]}},"report_ids":{"sandbox_job_ids":["6aa5c7431a1ea0860e0e07a9","67501c72ba4e44c84d0f4a67","67501c36ec76caf5f2051e60"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Zusy.Generic Sample cead013e2c3a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cead013e2c3a…. Malware family: Zusy.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample cead013e2c3a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cead013e2c3a…. Malware family: Zusy.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cead013e2c3a7335e5945972ecd71d9d0b9a2deec418a3fa693763320c22b212"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample cead013e2c3a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cead013e2c3a…. Malware family: Zusy.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]