34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 7f:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T45d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample d01148808fbe… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample d01148808fbe…. Threat score 35/100. 0/27 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c"],"about":{"@type":"SoftwareApplication","name":"d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c.bin","applicationCategory":["peexe","executable"],"identifier":"d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T460,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c.bin") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; File: "d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004060.00000001.137242.C099E000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005444.00000001.135031.00BE9000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005444.00000001.135031.00BE9000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005444.00000001.135031.00BE9000.00000002.mdmp")37:T419," \"%s\"\" (Source: \"00000000-00005444.00000001.135031.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"69d65f7fc0d8b8f77c09f8e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"Found reference string \"NetLocalGroupGetInfo\" (Indicator: \"netlocalgroupgetinfo\"; File: \"d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c.bin\")\n Found reference string \"NetGroupGetInfo\" (Indicator: \"netgroupgetinfo\"; File: \"d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c.bin\")\n Found reference string \"NetLocalGroupGetInfo\" (Indicator: \"netlocalgroupgetinfo\"; Source: \"00000000-00005444.00000001.135031.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"69d65f7fc0d8b8f77c09f8e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69d65f7fc0d8b8f77c09f8e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69d65f7fc0d8b8f77c09f8e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteServices\" (File: \"d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c.bin\")\n Found string \"DeleteServices\" (Source: \"00000000-00005444.00000001.135031.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"69d65f7fc0d8b8f77c09f8e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\" \"%s\"\" (Indicator: \"New-Object\"; File: \"d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c.bin\")\n Found string \"powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command \"$host.UI.RawUI.BufferSize = new-object System.Management.Automation.Host.Size(1024,50);\" \"&\"\"%s\"\"\" 2> \"%s\"\" (Indicator: \"New-Object\"; Source: \"00000000-00005444.00000001.135031.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"69d65f7fc0d8b8f77c09f8e6"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\" Microsoft Corporation\"\n \"MSI265A.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"pre26CA.tmp\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69d65f7fc0d8b8f77c09f8e6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"