24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample d4a00b95bf35… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d4a00b95bf35…. Malware family: Trojan.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d4a00b95bf358aff954f9da1668491c46b16d1ba3f9158ea8fb651ad902078cc","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","d4a00b95bf358aff954f9da1668491c46b16d1ba3f9158ea8fb651ad902078cc"],"about":{"@type":"SoftwareApplication","name":"07010ef323ff1a6efebf9c59f8afb35f","applicationCategory":["peexe","executable"],"identifier":"d4a00b95bf358aff954f9da1668491c46b16d1ba3f9158ea8fb651ad902078cc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T18e6,Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExA"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "EventUnregister"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "EventRegister"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin")26:T1250,Assembly shows XOR instruction xor eax ebp in Stream UID: 35191-101-0040B192 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35191-101-0040B192 Assembly shows XOR instruction xor eax ebp in Stream UID: 35191-316-00408E47 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35191-316-00408E47 Assembly shows XOR instruction xor eax esp in Stream UID: 35191-498-00401900 Assembly shows XOR instruction xor ecx esp in Stream UID: 35191-498-00401900 Assembly shows XOR instruction xor eax ebp in Stream UID: 35191-500-004017D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35191-500-004017D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 35191-501-004016E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35191-501-004016E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 35191-502-00401410 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35191-502-00401410 Assembly shows XOR instruction xor eax ebp in Stream UID: 35191-525-004015A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35191-525-004015A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 35191-578-00408992 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35191-578-00408992 Assembly shows XOR instruction xor eax ebp in Stream UID: 35191-614-00406B7B Assembly shows XOR instruction xor ecx ebp in Stream UID: 35191-614-00406B7B Assembly shows XOR instruction xor eax ebp in Stream UID: 35191-615-00406BD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35191-615-00406BD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 35191-616-00406CD6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35191-616-00406CD6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-18-0126F773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-18-0126F773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-46-01266C7B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-46-01266C7B Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00004800-35970-58-012669EE Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00004800-35970-58-012669EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-62-01266C25 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-62-01266C25 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00004800-35970-72-0127006C Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00004800-35970-72-0127006C Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00004800-35970-72-0127006C Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00004800-35970-72-0127006C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-87-01266128 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-87-01266128 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-115-0126B577 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-115-0126B577 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-116-0126B192 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-116-0126B192 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-118-0126B35F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-118-0126B35F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-119-0126B271 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-119-0126B271 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-120-0126AEFC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-120-0126AEFC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-134-01265784 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-134-01265784 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-195-01269D12 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-195-01269D12 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004800-35970-225-0126B783 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004800-35970-225-0126B78327:T7c4,"07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004800) "07010ef323ff1a6efebf9c59f8afb35f.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004800)28:T7c0,"07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")29:Tc3a,"07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "07010EF323FF1A6EFEBF9C59F8AFB35F.EXE"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "07010ef323ff1a6efebf9c59f8afb35f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")2a:T511,"07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "\Device\ConDrv\Server" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "\Device\ConDrv\\Reference" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "\Device\ConDrv\\Connect" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "\Device\ConDrv\\Input" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "\Device\ConDrv\\Output" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "C:\07010ef323ff1a6efebf9c59f8afb35f.exe" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "07010ef323ff1a6efebf9c59f8afb35f.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb"2b:T54b,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004800.00000000.69524.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004800.00000000.69524.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004800.00000000.69524.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004800.00000000.69524.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004800.00000000.69524.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004800.00000000.69524.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004800.00000000.69524.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004800.00000000.69524.00BB0000.00000004.mdmp")2c:T5fa,Found string "FlsAlloc" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: KERNELBASE.DLL) Found string "GetCurrentPackageId" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: KERNEL.APPCORE.DLL) Found string "LCMapStringEx" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: UCRTBASE.DLL) Found string "atan2" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: UCRTBASE.DLL) Found string "floor" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: UCRTBASE.DLL) Found string "ldexp" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: UCRTBASE.DLL) Found string "frexp" (Source: 07010ef323ff1a6efebf9c59f8afb35f, API is part of module: UCRTBASE.DLL)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d4a00b95bf358aff954f9da1668491c46b16d1ba3f9158ea8fb651ad902078cc","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791728191802,"unified_at":"2026-10-11T14:16:31.802Z","metadata":{"hashes":{"sha256":"d4a00b95bf358aff954f9da1668491c46b16d1ba3f9158ea8fb651ad902078cc","sha1":"9a3375fe48adb53fd2273f5f14631a8948aca0db","md5":"07010ef323ff1a6efebf9c59f8afb35f","sha512":"6609d51bb50e2090c6bea0c364007542388c9f41d4f29719695790cd7f887e70dc4a260f4d2bf84df84a87213d6127eb0492d84e7f25a97592fc7189bda4427d","ssdeep":"3072:ycURpkbWAEYaJZs09agPiaSMDlHX+NiqTQwG///J4G:+ObvEYaJycPj+V9GX/J4","ssdeep_chunks":["3072:ycURpkb","3072:cURpkbW","3072:URpkbWA","3072:RpkbWAE","3072:pkbWAEY","3072:kbWAEYa","3072:bWAEYaJ","3072:WAEYaJZ","3072:AEYaJZs","3072:EYaJZs0","3072:YaJZs09","3072:aJZs09a","3072:JZs09ag","3072:Zs09agP","3072:s09agPi","3072:09agPia","3072:9agPiaS","3072:agPiaSM","3072:gPiaSMD","3072:PiaSMDl","3072:iaSMDlH","3072:aSMDlHX","3072:SMDlHX+","3072:MDlHX+N","3072:DlHX+Ni","3072:lHX+Niq","3072:HX+NiqT","3072:X+NiqTQ","3072:+NiqTQw","3072:NiqTQwG","3072:iqTQwG/","3072:qTQwG//","3072:TQwG///","3072:QwG///J","3072:wG///J4","3072:G///J4G","6144:ycURpkb","6144:cURpkbW","6144:URpkbWA","6144:RpkbWAE","6144:pkbWAEY","6144:kbWAEYa","6144:bWAEYaJ","6144:WAEYaJZ","6144:AEYaJZs","6144:EYaJZs0","6144:YaJZs09","6144:aJZs09a","6144:JZs09ag","6144:Zs09agP","6144:s09agPi","6144:09agPia","6144:9agPiaS","6144:agPiaSM","6144:gPiaSMD","6144:PiaSMDl","6144:iaSMDlH","6144:aSMDlHX","6144:SMDlHX+","6144:MDlHX+N","6144:DlHX+Ni","6144:lHX+Niq","6144:HX+NiqT","6144:X+NiqTQ","6144:+NiqTQw","6144:NiqTQwG","6144:iqTQwG/","6144:qTQwG//","6144:TQwG///","6144:QwG///J","6144:wG///J4","6144:G///J4G","3072:+ObvEYa","3072:ObvEYaJ","3072:bvEYaJy","3072:vEYaJyc","3072:EYaJycP","3072:YaJycPj","3072:aJycPj+","3072:JycPj+V","3072:ycPj+V9","3072:cPj+V9G","3072:Pj+V9GX","3072:j+V9GX/","3072:+V9GX/J","3072:V9GX/J4"],"imphash":"a3cf945a20d635ef0ec099a6749f00e9","pehash":"5e6ac6abfebd3be0968f27b4a8a01858d70f4618"},"file_info":{"file_name":"07010ef323ff1a6efebf9c59f8afb35f","file_type":["peexe","executable"],"file_type_id":"exe","file_size":103936,"entropy":6.4,"compile_timestamp":"2026-02-24T13:23:16","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1784023972000,"last_seen":1789069972000,"last_multi_scan":1789069972000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":6,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":67723,"raw_size":68096},{"name":".rdata","virtual_address":"0x12000","virtual_size":26456,"raw_size":26624},{"name":".data","virtual_address":"0x19000","virtual_size":4780,"raw_size":2560},{"name":".gfids","virtual_address":"0x1b000","virtual_size":228,"raw_size":512},{"name":".rsrc","virtual_address":"0x1c000","virtual_size":480,"raw_size":512},{"name":".reloc","virtual_address":"0x1d000","virtual_size":4176,"raw_size":4608}],"section_names":[".text",".rdata",".data",".gfids",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["analysis"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":42},"sandbox_signatures":{"informative_count":82,"suspicious_count":13,"malicious_count":5,"total":100},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Proxy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.40296791","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.40296791 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kimsuky.CO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 006e28111 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agent.103936.ABK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.GPCC-6064","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kimsuky.Win32.224","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Able to check if a debugger is running"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"suspicious","value":"Contains ability to terminate a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup failed with error: %d\n\" (Indicator: \"wsastartup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup failed with error: %d\n\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1095","id":"string-228","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup failed with error: %d\n\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004800.00000000.69524.00BB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" queried SystemProcessInformation at 00000000-00004800-00000C15-78329113 [PID: 4800]\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" queried SystemProcessInformation at 00000000-00004800-00000C15-78338982 [PID: 4800]\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" queried SystemProcessInformation at 00000000-00004800-00000C15-78569759 [PID: 4800]\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" queried SystemProcessInformation at 00000000-00004800-00000C15-78579647 [PID: 4800]\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" queried SystemProcessInformation at 00000000-00004800-00000C15-78740186 [PID: 4800]\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" queried SystemProcessInformation at 00000000-00004800-00000C15-78749220 [PID: 4800]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 35191-526-00401D93\n SetUnhandledExceptionFilter@KERNEL32.dll at 35191-834-004024D1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004800-35970-87-01266128\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004800-35970-309-01261260\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004800-35970-313-01261D93\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004800-35970-342-0126236F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004800-35970-650-012624D1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004800.00000000.69524.00BB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004800.00000000.69524.00BB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004800.00000000.69524.00BB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 102753; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 100840; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 101444; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 102734; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameW\" (Source: \"00000000-00004800.00000000.69524.00BB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004800.00000000.69524.00BB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004800)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004800)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExA@KERNEL32.dll at 35191-578-00408992\n FindFirstFileExA@KERNEL32.DLL at 00000000-00004800-35970-400-01268992","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004800-35970-360-01262261","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004800-35970-360-01262261","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 35191-851-0040A258\n GetProcessHeap@KERNEL32.DLL at 00000000-00004800-35970-663-0126A258","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 19281)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00004800.00000000.69524.01272000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004800.00000000.69524.01272000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004800)\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004800)\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" called \"LoadLibrary\" with a parameter advapi32 (UID: 00000000-00004800)\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004800)\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00004800)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 35191-498-00401900\n WaitForMultipleObjects@KERNEL32.dll at 35191-500-004017D0\n WaitForSingleObject@KERNEL32.dll at 35191-501-004016E0\n Sleep@KERNEL32.dll at 35191-502-00401410\n Sleep@KERNEL32.DLL at 00000000-00004800-35970-289-01261900\n WaitForMultipleObjects@KERNEL32.DLL at 00000000-00004800-35970-292-012617D0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00004800-35970-293-012616E0\n Sleep@KERNEL32.DLL at 00000000-00004800-35970-294-01261410\n WaitForMultipleObjects@KERNEL32.DLL at 00000000-00004800-35970-309-01261260","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00004800-35970-60-01266A8A\n LoadLibraryExW@KERNEL32.DLL at 00000000-00004800-35970-299-01262E3A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 07010ef323ff1a6efebf9c59f8afb35f.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\LPRMUTEXOBJECT\"\n Process 07010ef323ff1a6efebf9c59f8afb35f.exe created mutex with name \"LPRMUTEXOBJECT\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"07010ef323ff1a6efebf9c59f8afb35f\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72540000\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 75a70000\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 75a70000\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" loaded module \"ADVAPI32\" at base 769e0000\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 75a70000\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-1\" at base 76240000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76440000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 764A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"07010ef323ff1a6efebf9c59f8afb35f\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"07010ef323ff1a6efebf9c59f8afb35f\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"07010ef323ff1a6efebf9c59f8afb35f\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"07010ef323ff1a6efebf9c59f8afb35f\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"07010ef323ff1a6efebf9c59f8afb35f\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"07010ef323ff1a6efebf9c59f8afb35f\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"07010ef323ff1a6efebf9c59f8afb35f\" file has an entrypoint instructions - \"call\t0x402261,jmp\t0x401c0d,push\tebp,mov\tebp, esp,push\t0,call\tdword ptr [0x412128],push\tdword ptr [ebp + 8],call\tdword ptr [0x412058],push\t0xc0000409,call\tdword ptr [0x41205c],push\teax,call\tdword ptr [0x412060],pop\tebp,ret\t,push\tebp,mov\tebp, esp,sub\tesp, 0x324,push\t0x17,call\t0x410634,test\teax, eax,je\t0x401dd4,push\t2,pop\tecx,int\t0x29,mov\tdword ptr [0x419968], eax,mov\tdword ptr [0x419964], ecx,mov\tdword ptr [0x419960], edx,mov\tdword ptr [0x41995c], ebx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"07010ef323ff1a6efebf9c59f8afb35f\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" trying to access non-existent file \"C:\\MSVCP140.DLL\"\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" trying to access non-existent file \"C:\\MSVCP140.dll\"\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.DLL\"\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\"\n \"07010ef323ff1a6efebf9c59f8afb35f.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 07010ef323ff1a6efebf9c59f8afb35f]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\07010ef323ff1a6efebf9c59f8afb35f.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004800.00000000.69524.00BB0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\C:\\07010ef323ff1a6efebf9c5=4f00\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004800.00000000.69524.00BB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"07010ef323ff1a6efebf9c59f8afb35f\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.DLL at 00000000-00004800-35970-87-01266128\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00004800-35970-342-0126236F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"07010ef323ff1a6efebf9c59f8afb35f.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00004800-35970-340-0126261C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleExW@KERNEL32.DLL at 00000000-00004800-35970-134-01265784\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004800-35970-143-0126248D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 35191-618-0040716B\n GetStartupInfoW@KERNEL32.DLL at 00000000-00004800-35970-473-0126716B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\07010ef323ff1a6efebf9c59f8afb35f.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"ioctlsocket@WS2_32.DLL at 00000000-00004800-35970-289-01261900\n socket@WS2_32.DLL at 00000000-00004800-35970-293-012616E0\n socket@WS2_32.DLL at 00000000-00004800-35970-294-01261410\n ioctlsocket@WS2_32.DLL at 00000000-00004800-35970-312-012615A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 35191-869-004058BC\n GetCommandLineA@KERNEL32.DLL at 00000000-00004800-35970-673-012658BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.dll at 35191-576-00404FAD\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00004800-35970-364-012627CE\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00004800-35970-398-01264FAD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.dll at 35191-526-00401D93\n TerminateProcess@KERNEL32.DLL at 00000000-00004800-35970-86-01266302\n TerminateProcess@KERNEL32.DLL at 00000000-00004800-35970-133-01265743\n TerminateProcess@KERNEL32.DLL at 00000000-00004800-35970-313-01261D93","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"07010ef323ff1a6efebf9c59f8afb35f.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateFileW\n GetModuleHandleExW\n Sleep\n UnhandledExceptionFilter\n FindNextFileA\n IsDebuggerPresent\n FindFirstFileExA\n CreateThread\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n WriteFile\n GetModuleHandleW\n GetModuleFileNameW\n GetModuleFileNameA\n GetCommandLineW\n LoadLibraryExW\n TerminateProcess\n WSAStartup\n socket\n closesocket\n send\n connect\n recv","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]}],"intel_graph":{"map":{"File:d4a00b95bf358aff954f9da1668491c46b16d1ba3f9158ea8fb651ad902078cc":{"type":"File","value":"d4a00b95bf358aff954f9da1668491c46b16d1ba3f9158ea8fb651ad902078cc","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}}},"chains":[{"id":"1547696389496221113","root":"File:d4a00b95bf358aff954f9da1668491c46b16d1ba3f9158ea8fb651ad902078cc","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":32,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["analysis"],"sample_flags":["User Comment"],"sandbox_reports":[{"id":"6aa30a928f09e58f3506022f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Kimsuky","submit_name":"07010ef323ff1a6efebf9c59f8afb35f","analysis_start_time":"2026-09-10T19:54:52+00:00","indicators_count":{"informative":80,"suspicious":16,"malicious":3},"tags":["User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}],"processes":[{"pid":4800,"ppid":0,"name":"07010ef323ff1a6efebf9c59f8afb35f.exe","command_line":"","sha256":"d4a00b95bf358aff954f9da1668491c46b16d1ba3f9158ea8fb651ad902078cc","normalized_path":"C:\\07010ef323ff1a6efebf9c59f8afb35f.exe","uid":"00000000-00004800","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["wow64win.dll","win32u.dll","ole32.dll","kernel.appcore.dll","vcruntime140.dll","kernel32.dll","apphelp.dll","sspicli.dll","advapi32.dll","gdi32full.dll","msvcp140.dll","wow64.dll","user32.dll","rpcrt4.dll","cryptbase.dll","bcryptprimitives.dll","ucrtbase.dll","KernelBase.dll","msvcrt.dll","msvcp_win.dll","gdi32.dll","combase.dll","wow64cpu.dll","ws2_32.dll","oleaut32.dll","shlwapi.dll","ntdll.dll","sechost.dll","VxSSL32.dll","fltLib.dll","imm32.dll","cryptsp.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\LPRMUTEXOBJECT","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]},{"name":"LPRMUTEXOBJECT","sources":[{"report_type":"sandbox","report_id":"6aa30a928f09e58f3506022f"}]}]}},"report_ids":{"sandbox_job_ids":["6aa30a928f09e58f3506022f"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample d4a00b95bf35… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d4a00b95bf35…. Malware family: Trojan.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d4a00b95bf358aff954f9da1668491c46b16d1ba3f9158ea8fb651ad902078cc"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample d4a00b95bf35… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d4a00b95bf35…. Malware family: Trojan.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d4a00b95bf358aff954f9da1668491c46b16d1ba3f9158ea8fb651ad902078cc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample d4a00b95bf35… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d4a00b95bf35…. Malware family: Trojan.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]