23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample d727ed3228dc… — Score 72/100 — Hybrid Analysis","description":"Malicious verdict for sample d727ed3228dc…. Malware family: Trojan.Generic. Threat score 72/100. 18/29 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d727ed3228dc16b400e23417c729da982b1e69f0fbb5e4a6e9dd40f1ce46642f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","d727ed3228dc16b400e23417c729da982b1e69f0fbb5e4a6e9dd40f1ce46642f"],"about":{"@type":"SoftwareApplication","name":"Microsoft20Firewall20Upgrade1.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"d727ed3228dc16b400e23417c729da982b1e69f0fbb5e4a6e9dd40f1ce46642f","additionalType":"Malicious sample"},"threatScore":72,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":29},"behavioralIndicators":{"malicious":6,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T509,"" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77040000 "" loaded module "PROFAPI.DLL" at base 75030000 "" loaded module "SETUPAPI.DLL" at base 75600000 "" loaded module "APPHELP.DLL" at base 74F30000 "" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6FE10000 "" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75B30000 "" loaded module "PROPSYS.DLL" at base 73DF0000 "" loaded module "OLEAUT32.DLL" at base 75380000 "" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 754C0000 "" loaded module "SHELL32.DLL" at base 75B30000 "" loaded module "MPR.DLL" at base 71960000 "" loaded module "USER32.DLL" at base 75A60000 "" loaded module "%WINDIR%\SYSTEM32\DRPROV.DLL" at base 6F460000 "" loaded module "%WINDIR%\SYSTEM32\NTLANMAN.DLL" at base 6F440000 "" loaded module "%WINDIR%\SYSTEM32\DAVCLNT.DLL" at base 6F420000 "" loaded module "ADVAPI32.DLL" at base 76C60000 "" loaded module "RPCRT4.DLL" at base 75410000 "" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 7704000025:Tb2c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAf2SURBVFhHtZdnVJVXFobjyvyZycSSTIxmomAXCwICg4AGoxCCgEYNsUXp5SKg4SpGHEUERekiUsQSoihN2qWoFxELUpSiBqNyQZAuoowFo8AzB41r5cesQaJ+a+31/fq+9znv3meffd577w2ejIxscrLlJCQk8wa/6f+nOTlybt1UcDUlkSP5MVytqCAv7zx+YdvfPcjZsxeIDA+nNSqEBt+NbDrugme8K34xXpw+fY7IyMh3AyGXn6a0tIzWX67QkXqU9v27adomxSPRGtcjy1h7yIoA2RYuXCgkPT2b8KCotwNSVFRC/Z07nMvP59mtSp6WFfH4dCYdcVHcDfw33jIJbnEWOB5YiHPMEjxinQgOCiRPuHHs6Iva6D9IQUERHR0ddD55wv32dpqultNZUcLz27d4duMqnRdO8TDpAPf2eLPz1BqkCcuQ/LQQm2gz7CIX47B3OTvTNqO4VSXScvaFI6EhYWzy9OwbprS0gsyMDEqzZLRly7iXfIyHpzLpvHyRZ1XXeVZZRuf5EzxKPkB7+Db889awPmU5LnGLsd1vzspwY5aEGrE81AzrEAukB53xT/IhMTGe5OS0vh25ebOK9OgompKO0XQohrv799IRH8tjuYAoPkvnRTmPsxPo+DmM9oAN+Jx2wj19Cc4Ji7CLNef7SBO+DZnDAn8D5vsZsHCXIZZhFqwLWEtKiqxvgMrKG+TFRFF/cB/1u3xp9t9Ge/RuHib/zKPMRB6mxNJxaDftgZto9bBDmrWc1amLcEycj81hM1bsM8YiTAAEGGDmN4uvffRZtMsYt0An0tKy+ga4fLmcS7EHqY8Io/ZHKU1bPGgL8eX+vmAeRPtzP9iLe97utLpZ0vS9ObYpptgkmWIdP49VR0xYcdCYbyMEQLABpjv1+cpbh6+9ZyIJsiMj40TfAMXFlynpBQgNoNbNiUZ3R1q93Lm7bR13N0poXb2S5pXf0LhgLvVzdVmeYMScaFW0gkei5a/EdJ+RqHp+hsraoYyVfIyy9RCmSJSRBNggk53sG6B3H+dGRXAnaCe1EjsaXG1oXmdPyxqx4lUvhRuM9KnX1aBq0AeoBg5HLehzpvcCBCuh6aeEmtfnTF4/jLHOH6NkPZipklHY+1qSlXWqb4Dc3HySQoK4E7CDWidrAWBF8xprmqwW0jDPgFqV0VQN/BuKgX+nesggJvl/hmrQSDRCldEKHY120Gim71Bmquc/Ge82FCXbQahKRmPvbcWJE/K+AWSybIJ9fbgjCrDWYRWNzpY0C9ublpqhGDaYqg//iuLDD6j+aAg1Q4cyOXAEaqGj0Awbi074BHTDxqMdMAYNb2UmrRvOKIePUF89Djt3a5GCnL4BkpNSOZmTQ32gH7WOAkCyknoLE2omj0LxycCXKxfit4d9Su2IEUwLHYOWEJ4ROZmZ0VOZFTkFvd0qaO8Yy7QfRzDO+RO010xi36FItm3z6Rug92y8d7eNxojd1DlZUmMibJ8zg+qJSij+MYjqwYOo+XToC/G68WK1EZPQ3zcNgwMazDmkyZz9GsyOUEU3YCIam5VRcRuOgYc2LY1NuLq59t0JewGKi0txOnwFE98CtF1OoPtDDhMcUhhheRRl2yOMdzzCVNejaEkT6FZo012tT3fNF/TUGNCjmEV3pR7PirV4fGoK91Mm8khuRHnZFZQHf/B6APn5BdhGXeJfq3OY7piJrlsmUxyOo2QZxxi7w0xxjkPTPZ4vPJPprpopAOYKAGMBIEJhKAAM+K1wBvezVWmNV6HjpDrFRZdez/5eBw4ejCUkKJhZ7idQs8tAxyUTNadUxljHM87hKKquCczwSGbOllQh/iXdt+fRU/sNPbfnCwATuirnipatT1umOg3HJrDd00pMTq/RA/44GxUVlWLucwY1hyw0JTI0JOmMt00SqUhEzS0J3Q2pzPWS0VNtJITN6albJCBEKMzp+sWIJwUCQKYhzhQVfr3+K5MnTnh9B3pBEhNScN0cjN6aHNTtZWg6yVCxS2G8fRKqLsfRWZ/G7M1ZAsBEACwQ4ovF+3eAq4Y8Oa/LPZk6icH6XBcA/Z4LJgriutt1GHvK0ZLkoCFqQdW+14UUJktS0PwhnVkbM0XezYTwwhcA1Ij3TVO6KmbzJF+HByIFLY3NeHh49B/ghQuJwoWYAr5cL0dbko2GUxYTbdKEE2louMrQ88iG2qUiVkDdMqgWAJVGdJXo8TRfj0cX5lJTXfPnxHsB/vL++9wSU83S4IsYbshD1+Uk6k7ZqEmy0JHmYOB5ChocX0adlUjHd3Rf+4quwtliFyygSex9PV2dPw/QCxEWtodjcXGsCC7EdPM5jDzPYLgpTxyx+SzYeY6eFik9zVK6G1zEVrTh+bXv+K18JTu2b+euaGj9zv3/uiXk5p5l885wnGLKsd1bhm1EKfYxZWIOLKe7bbsIH7pbttBVJ+X5TQ+yjnry9OnTV+Kv13z+3/VkwIABFBQUE5h4lq0ZVWISVuCbU82O3Bq6/hNJV8deutpC6GoMoq0qls7OTpSVRr6d1b8Cs7G2FhAlhBQ2sudiI5GXGtlX3kzX40N0PYwVECLaE2lpacXLa+vbFX8FsWzZUgoLLxGdJuenG+0cq3lA99Pj9HSmc/tmBlWKGqRS6bsRfwWhoa5OSUkZtaJHbNnqI4ptK82i2isqrmFqOu/div+hTjA0NCQpORW5/AwWFhZvr+D6eVd+Y+H/Am5D7qu5jJrLAAAAAElFTkSuQmCC1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"d727ed3228dc16b400e23417c729da982b1e69f0fbb5e4a6e9dd40f1ce46642f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":72,"unified_at_epoch_ms":1790597890169,"unified_at":"2026-09-28T12:18:10.169Z","metadata":{"hashes":{"sha256":"d727ed3228dc16b400e23417c729da982b1e69f0fbb5e4a6e9dd40f1ce46642f","sha1":"19e34f9683c84c2d8dfff46b3850260350068dbc","md5":"420433b8f42d47b1e7075b4562fc8d3f","sha512":"3613a42efdbf30a558c3983a3f30bfb645cdb036eef157ccf691dc9f4c4e0530f85db792bde15ed5aca1bd9d374871f922ef877931b93e419ac07813dd883aa3","ssdeep":"6144:0k3+9Pl4GNcnpMklqccF/5C7+yPMH4UKpBI78X3wMklqccF/5C7+IjMklqccF/5d:/3++S/5u+y0Wpu8X3x/5u+Is/5u+","ssdeep_chunks":["6144:0k3+9Pl","6144:k3+9Pl4","6144:3+9Pl4G","6144:+9Pl4GN","6144:9Pl4GNc","6144:Pl4GNcn","6144:l4GNcnp","6144:4GNcnpM","6144:GNcnpMk","6144:NcnpMkl","6144:cnpMklq","6144:npMklqc","6144:pMklqcc","6144:MklqccF","6144:klqccF/","6144:lqccF/5","6144:qccF/5C","6144:ccF/5C7","6144:cF/5C7+","6144:F/5C7+y","6144:/5C7+yP","6144:5C7+yPM","6144:C7+yPMH","6144:7+yPMH4","6144:+yPMH4U","6144:yPMH4UK","6144:PMH4UKp","6144:MH4UKpB","6144:H4UKpBI","6144:4UKpBI7","6144:UKpBI78","6144:KpBI78X","6144:pBI78X3","6144:BI78X3w","6144:I78X3wM","6144:78X3wMk","6144:8X3wMkl","6144:X3wMklq","6144:3wMklqc","6144:wMklqcc","6144:F/5C7+I","6144:/5C7+Ij","6144:5C7+IjM","6144:C7+IjMk","6144:7+IjMkl","6144:+IjMklq","6144:IjMklqc","6144:jMklqcc","6144:qccF/5d","12288:0k3+9Pl","12288:k3+9Pl4","12288:3+9Pl4G","12288:+9Pl4GN","12288:9Pl4GNc","12288:Pl4GNcn","12288:l4GNcnp","12288:4GNcnpM","12288:GNcnpMk","12288:NcnpMkl","12288:cnpMklq","12288:npMklqc","12288:pMklqcc","12288:MklqccF","12288:klqccF/","12288:lqccF/5","12288:qccF/5C","12288:ccF/5C7","12288:cF/5C7+","12288:F/5C7+y","12288:/5C7+yP","12288:5C7+yPM","12288:C7+yPMH","12288:7+yPMH4","12288:+yPMH4U","12288:yPMH4UK","12288:PMH4UKp","12288:MH4UKpB","12288:H4UKpBI","12288:4UKpBI7","12288:UKpBI78","12288:KpBI78X","12288:pBI78X3","12288:BI78X3w","12288:I78X3wM","12288:78X3wMk","12288:8X3wMkl","12288:X3wMklq","12288:3wMklqc","12288:wMklqcc","12288:F/5C7+I","12288:/5C7+Ij","12288:5C7+IjM","12288:C7+IjMk","12288:7+IjMkl","12288:+IjMklq","12288:IjMklqc","12288:jMklqcc","12288:qccF/5d","6144:/3++S/5","6144:3++S/5u","6144:++S/5u+","6144:+S/5u+y","6144:S/5u+y0","6144:/5u+y0W","6144:5u+y0Wp","6144:u+y0Wpu","6144:+y0Wpu8","6144:y0Wpu8X","6144:0Wpu8X3","6144:Wpu8X3x","6144:pu8X3x/","6144:u8X3x/5","6144:8X3x/5u","6144:X3x/5u+","6144:3x/5u+I","6144:x/5u+Is","6144:/5u+Is/","6144:5u+Is/5","6144:u+Is/5u","6144:+Is/5u+"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Microsoft20Firewall20Upgrade1.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":538112,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499296371000,"last_seen":1661676739000,"last_multi_scan":1661676739000}},"detections":{"summary":{"verdict":"malicious","score":72,"tags":null},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":16,"malicious_count":6,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Suloc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.538112.60","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Autoruns.GenericKD.36145181","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.SFUH-8801","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Autoruns.GenericKD.36145181 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/Agent.QZU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.brlv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.yk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.ealxqt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Generic-L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_SULOC.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_SULOC.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.ANCH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.657652","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\OneDrive\\Projects\\Jai Dave\\OSFirewall\\OSFirewall\\obj\\Debug\\OSFirewall.pdb\"\n \"D:\\OneDrive\\Projects\\Jai Dave\\OSFirewall\\OSFirewallUpdate\\obj\\Debug\\Microsoft Firewall Upgrade.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$24","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll\" at 692E0000\n \"OSFirewall.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll\" at 692E0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"ConvertSidToStringSidW@sechost.dll\"\n \"CM_Get_Device_Interface_List_Size_ExW@SETUPAPI.dll\"\n \"CM_Get_Device_Interface_List_ExW@SETUPAPI.dll\"\n \"RegQueryValueW@ADVAPI32.dll\"\n \"DllGetClassObject@shdocvw.dll\"\n \"DllCanUnloadNow@shdocvw.dll\"\n \"DllGetClassObject@shell32.dll\"\n \"DllCanUnloadNow@shell32.dll\"\n \"PSPropertyBag_ReadDWORD@PROPSYS.dll\"\n \"PSPropertyBag_ReadBSTR@PROPSYS.dll\"\n \"PSPropertyBag_ReadGUID@PROPSYS.dll\"\n \"RegOpenKeyExW@ADVAPI32.dll\"\n \"RegGetValueW@ADVAPI32.dll\"\n \"RegCloseKey@ADVAPI32.dll\"\n \"InitPropVariantFromStringAsVector@PROPSYS.dll\"\n \"PSCoerceToCanonicalValue@PROPSYS.dll\"\n \"PropVariantToStringAlloc@PROPSYS.dll\"\n \"DllGetClassObject@urlmon.dll\"\n \"DllCanUnloadNow@urlmon.dll\"\n \"GetUserNameExW@SspiCli.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"OSFirewall.exe\" (UID: 00157984-00002684)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00139453-00002600-76F4228D-156094\n LookupAccountNameLocalW@SECHOST.DLL at 00139453-00002600-76F4228D-157237","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"OSFirewall.exe.143421\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00139453-00002600-76F261F8-160423","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries volume information","description":"\"OSFirewall.exe\" queries volume information of \"%APPDATA%\\Microsoft\\OSFirewall.exe\" at 00157984-00002684-76F26268-160625","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Users\\PSPUBWS\\Searches\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%WINDIR%\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"OSFirewall.exe.143421\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"OSFirewall.exe\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"OS FIREWALL\", Value: \"%APPDATA%\\Microsoft\\OSFirewall.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"ALWAYSSHOWEXT\")\n \"\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4E7D0841\" to virtual address \"0x6A2A2AFC\" (part of module \"CLR.DLL\")\n \"OSFirewall.exe\" wrote bytes \"1C9B944B\" to virtual address \"0x6A2A2AFC\" (part of module \"CLR.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN\")\n \"OSFirewall.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/54 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"OSFirewall.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 376320 bytes starting with PE header signature to file \"%APPDATA%\\Microsoft\\OSFirewall.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"OSFirewall.exe\" (PID: 00002684)\n \"\" wrote 52 bytes to a foreign process \"OSFirewall.exe\" (PID: 00002684)\n \"\" wrote 4 bytes to a foreign process \"OSFirewall.exe\" (PID: 00002684)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"OSFirewall.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"OSFirewall.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"level":"malicious","category":"General","name":"The input sample dropped a file that was identified as malicious","description":"3/55 Antivirus vendors marked dropped file \"OSFirewall.exe.1679504050\" as malicious (classified as \"S-89dfb9aa\" with 5% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":82,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":45,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":5,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"56bf7ff30e316dd657b75c00","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":72,"malware_family":"S-89dfb9aa","submit_name":"Microsoft Firewall Upgrade(1).exe","analysis_start_time":"2016-02-13T13:12:07+00:00","indicators_count":{"informative":6,"suspicious":17,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"56be54bb0e316d867fd3f3f0","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":63,"malware_family":"S-89dfb9aa","submit_name":"Microsoft20Firewall20Upgrade1.exe","analysis_start_time":"2016-02-12T15:55:54+00:00","indicators_count":{"informative":8,"suspicious":13,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}],"processes":[{"pid":2600,"ppid":0,"name":"Microsoft20Firewall20Upgrade1.exe","command_line":"","normalized_path":"","uid":"00139453-00002600","icon":"$25"},{"pid":2684,"ppid":0,"name":"OSFirewall.exe","command_line":"","normalized_path":"","uid":"00157984-00002684"}],"all_imported_dlls":["DEVOBJ.dll","SETUPAPI.dll","mscorlib.ni.dll","wkscli.dll","IMM32.DLL","ntdll.dll","ADVAPI32.dll","netutils.dll","nlssorting.dll","msvcrt.dll","USER32.dll","CFGMGR32.dll","MSCOREE.DLL","KERNELBASE.dll","CRYPTBASE.dll","System.Windows.Forms.ni.dll","urlmon.dll","GDI32.dll","OLEAUT32.dll","SspiCli.dll","RPCRT4.dll","LPK.dll","MSCTF.dll","SHLWAPI.dll","clr.dll","KERNEL32.dll","clrjit.dll","System.ni.dll","System.Drawing.ni.dll","PROPSYS.dll","profapi.dll","apphelp.dll","MPR.dll","sechost.dll","PSAPI.DLL","mscoreei.dll","uxtheme.dll","drprov.dll","davclnt.dll","rsaenh.dll","comctl32.dll","ntmarta.dll","ntlanman.dll","cscapi.dll","VERSION.dll","shell32.dll","CLBCatQ.DLL","shdocvw.dll","CRYPTSP.dll","ole32.dll","USP10.dll","rpcrt4.dll","gdi32.dll","cryptbase.dll","iertutil.dll","user32.dll","lpk.dll","imm32.dll","System.Windows.Forms.dll","wininet.dll","crypt32.dll","sspicli.dll","kernel32.dll","advapi32.dll","msctf.dll","devobj.dll","cryptsp.dll","mscoree.dll","KernelBase.dll","shlwapi.dll","clbcatq.dll","GdiPlus.dll","WindowsCodecs.dll","dwmapi.dll","Wldap32.dll","cfgmgr32.dll","setupapi.dll","msasn1.dll","usp10.dll","msvcr110_clr0400.dll","propsys.dll","oleaut32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"OSFirewall.exe","sha256":"8ddd5fd3c3fb7044b847f6290f3c9d6be3db8fd42fa21316dca08aadba5e0908","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"path":"%SAMPLEDIR%\\Microsoft20Firewall20Upgrade1.exe.config","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.log","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%SAMPLEDIR%\\Microsoft20Firewall20Upgrade1.exe","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"path":"%WINDIR%\\assembly\\pubpol15.dat","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\22ae167d586450ad3a9b9a9ee43ebc86\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\72269ea7cc6281139e4d155e7c57dc67\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\e40da7a49f8c3f0108e7c835b342f382\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%APPDATA%\\Microsoft\\OSFirewall.exe","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"path":"%APPDATA%\\Microsoft\\OSFirewall.exe.config","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SortDefault.nlp","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"C:\\Microsoft_Firewall_Upgrade_1_.exe.config","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"C:\\Microsoft_Firewall_Upgrade_1_.exe","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\OS FIREWALL\\OS FIREWALL","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"},{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56be54bb0e316d867fd3f3f0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56bf7ff30e316dd657b75c00"}]}]}},"report_ids":{"sandbox_job_ids":["56bf7ff30e316dd657b75c00","56be54bb0e316d867fd3f3f0"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample d727ed3228dc… — Score 72/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d727ed3228dc…. Malware family: Trojan.Generic. Threat score 72/100. 18/29 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d727ed3228dc16b400e23417c729da982b1e69f0fbb5e4a6e9dd40f1ce46642f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample d727ed3228dc… — Score 72/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d727ed3228dc…. Malware family: Trojan.Generic. Threat score 72/100. 18/29 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d727ed3228dc16b400e23417c729da982b1e69f0fbb5e4a6e9dd40f1ce46642f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample d727ed3228dc… — Score 72/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d727ed3228dc…. Malware family: Trojan.Generic. Threat score 72/100. 18/29 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L26","11",{}]]