24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample d98deedd3f4e… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample d98deedd3f4e…. Malware family: Win/malicious_confidence_90%. Threat score 85/100. 8/25 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d98deedd3f4e5ead06704ad629f473ab908d7522f1a81dfb0bd2d423f18f814d","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","d98deedd3f4e5ead06704ad629f473ab908d7522f1a81dfb0bd2d423f18f814d"],"about":{"@type":"SoftwareApplication","name":"random.exe","applicationCategory":["peexe","executable"],"identifier":"d98deedd3f4e5ead06704ad629f473ab908d7522f1a81dfb0bd2d423f18f814d","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":8,"total":25},"behavioralIndicators":{"malicious":2,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9d6,"random.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000000b407455a383d7725000e601687d7676f8efe60140b1d7726fd04b26feffffff14efe6010272d672b8eee60100005077b0efe6011b72d672e0dfbe7508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000040efe6010000000008000000000000000000000000000000000000000000000000000000334074550000000080efe6016992e076ffffffff3400000040efe601080000000000000000005077b0efe6012794e07648efe6010b0000000000000098efe601 (UID: 00000000-00000324) "random.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000324) "random.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000324) "random.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000038efe601dceee601226e907600002d04000000002d6e90768f0938f82d000000ecb74e7460efe6010000f903c8870a0408ae09041400000080000000a0eee6010000f90324efe60170c89176ab96488ffeffffff2d000000d0cc5d7427000000f4eee601856a92761c23977634efe601f85f927608000000bb699176b2699176670838f82d000000ecb74e7427000000d0cc5d7408efe6012d000000d0cc5d742700000038efe601856a92761c23977680efe6017e8a5c74ee8c5c74738a5c74c74172b62d000000ecb74e7427000000d0cc5d74849b2d04189b2d04c74172b648efe601fc529a7434f0e601e0845c747f5f0cc3feffffff738a5c74 (UID: 00000000-00000324)26:Tbf0,"random.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-convert-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-environment-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-filesystem-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-heap-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-locale-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-math-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-private-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-runtime-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-stdio-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-string-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-time-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter api-ms-win-crt-utility-l1-1-0.dll (UID: 00000000-00000324) "random.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000324)27:T1393,"random.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000324) "random.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00000324)28:Ta36,"random.exe" loaded module "KERNEL32" at base 76320000 "random.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76d00000 "random.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76d00000 "random.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76d00000 "random.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76490000 "random.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76d00000 "random.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76d00000 "random.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76d00000 "random.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d00000 "random.exe" loaded module "USER32.DLL" at base 76b80000 "random.exe" loaded module "ADVAPI32.DLL" at base 74440000 "random.exe" loaded module "NTDLL.DLL" at base 776b0000 "random.exe" loaded module "WINMM.DLL" at base 72c30000 "random.exe" loaded module "NTDLL" at base 776b0000 "random.exe" loaded module "KERNEL32.DLL" at base 76320000 "random.exe" loaded module "BCRYPT.DLL" at base 72ea0000 "random.exe" loaded module "CRYPT32.DLL" at base 76140000 "random.exe" loaded module "GDI32.DLL" at base 77500000 "random.exe" loaded module "GDIPLUS.DLL" at base 73d60000 "random.exe" loaded module "IPHLPAPI.DLL" at base 73ff0000 "random.exe" loaded module "MSVCRT.DLL" at base 768c0000 "random.exe" loaded module "OLE32.DLL" at base 77560000 "random.exe" loaded module "SHELL32.DLL" at base 744c0000 "random.exe" loaded module "API-MS-WIN-CRT-CONVERT-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "API-MS-WIN-CRT-HEAP-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "API-MS-WIN-CRT-LOCALE-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "API-MS-WIN-CRT-MATH-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "API-MS-WIN-CRT-STDIO-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "API-MS-WIN-CRT-STRING-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "API-MS-WIN-CRT-TIME-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "API-MS-WIN-CRT-UTILITY-L1-1-0.DLL" at base 75bc0000 "random.exe" loaded module "WS2_32.DLL" at base 743d0000 "random.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7632000029:T42b,"random.exe" file has an entrypoint instructions - "jmp 0x109100a,pmaxub mm0, qword ptr [ebx],add byte ptr [eax], al,add byte ptr [eax], al,jmp 0x109300f,add byte ptr [ecx], al,or al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax + 0xa], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,pop es,add byte ptr [eax], 0,add byte ptr [eax], al,add byte ptr [eax], al,adc byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add ecx, dword ptr [edx],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,xor byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add dword ptr [eax], eax,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2a:T7fd,"random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2b:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000324.00000000.234396.04090000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000324.00000000.234396.04090000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000324.00000000.234396.04090000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000324.00000000.234396.04090000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000324.00000000.234396.04090000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000324.00000000.234396.04090000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000324.00000000.234396.04090000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000324.00000000.234396.04090000.00000004.mdmp")2c:T568,"random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2671759590 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2671769341 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2672061243 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2672069562 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2672832361 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2672841480 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2672927787 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2672937960 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2673101503 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2673111200 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2673351052 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2673360048 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2673626820 [PID: 324] "random.exe" queried SystemProcessInformation at 00000000-00000324-00000C13-2673636681 [PID: 324]2d:T4c1,"15001600c02e6a7344f62600f8506873@ADVAPI32.dll" "0e000f00702f6a7344f62600f8506873@ADVAPI32.dll" "0e000f00cc2f6a7344f62600f8506873@ADVAPI32.dll" "11001200b4376a7344f62600f8506873@ADVAPI32.dll" "1100120048386a7344f62600f8506873@ADVAPI32.dll" "120013008c386a7344f62600f8506873@ADVAPI32.dll" "12001300e4386a7344f62600f8506873@ADVAPI32.dll" "14001500385e6a7344f62600f8506873@ADVAPI32.dll" "14001500505e6a7344f62600f8506873@ADVAPI32.dll" "14001500685e6a7344f62600f8506873@ADVAPI32.dll" "17001800805e6a7344f62600f8506873@ADVAPI32.dll" "0d000e00985e6a7344f62600f8506873@ADVAPI32.dll" "11001200a85e6a7344f62600f8506873@ADVAPI32.dll" "11001200bc5e6a7344f62600f8506873@ADVAPI32.dll" "0f001000fc5f6a7344f62600f8506873@ADVAPI32.dll" "140015003c606a7344f62600f8506873@ADVAPI32.dll" "1400150054606a7344f62600f8506873@ADVAPI32.dll" "0c000d009c606a7344f62600f8506873@ADVAPI32.dll" "0c000d00ac606a7344f62600f8506873@ADVAPI32.dll" "0e000f00bc606a7344f62600f8506873@ADVAPI32.dll" "0e000f00cc606a7344f62600f8506873@ADVAPI32.dll" "0b000c00dc606a7344f62600f8506873@ADVAPI32.dll" "1800190014636a7344f62600f8506873@RPCRT4.dll" "1300140040636a7344f62600f8506873@RPCRT4.dll" "1400150054636a7344f62600f8506873@RPCRT4.dll"2e:T5d3,Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00005992.00000000.171768.003E0000.00000004.mdmp, 00000000-00005992.00000001.171920.003E0000.00000004.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00005992.00000001.171920.003E0000.00000004.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00005992.00000001.171920.003E0000.00000004.mdmp") Found reference to "HMAC-DRBG" (Indicator: "HMAC"; Source: "00000000-00005992.00000001.171920.003E0000.00000004.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00005992.00000001.171920.003E0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00005992.00000001.171920.003E0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00005992.00000001.171920.003E0000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00005992.00000001.171920.003E0000.00000004.mdmp, 00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found reference to "HKDF" (Indicator: "HKDF"; Source: "00000000-00005992.00000001.171920.003E0000.00000004.mdmp, 00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found reference to "HMAC-DRBG-KDF" (Indicator: "HMAC"; Source: "00000000-00005992.00000001.171920.003E0000.00000004.mdmp") Found reference to "SSHKDF" (Indicator: "HKDF"; Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp")2f:Tabd,"random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "")30:T108b,Found URL "http://o.ss2.us/0!http://x.ss2.us/x.cercryptdllencodepublickeyandparametersu1.3.14.3.2.22u1.3.14.3.2.127" - Source: "00000000-00005992.00000001.171920.003E0000.00000004.mdmp") Found URL "http://crl.rootg2.amazontrust.com/rootg2.crl*http://crl.r2m02.amazontrust.com/r2m02.crlprovider=default,fips=yes,input=msblob000000000000aes-256-wrap-padaes-256-wrap-padaes-192-wrap-padaes-192-wrap-padaes-128-wrap-padaes-128-wrap-padaes-256-wrap-invaes-256-wrap-invaes-192-wrap-invaes-192-wrap-invaes-128-wrap-invaes-128-wrap-invaes-256-wrap-pad-invaes256-wrap-pad-invaes-256-wrap-pad-invaes-192-wrap-pad-invtnaearia256aria192aria128des3sm4-gcmsm4-gcmsm4-ccmsm4-ccmsm4-ecbsm4-cbcsm4-ctrsm4-ofbsm4-cfbsm4-xtssm4-xtsaes192-wrap-pad-invaes-192-wrap-pad-invaes-128-wrap-pad-invaes128-wrap-pad-invaes-128-wrap-pad-invcamellia-256-ecbcamellia-192-ecbcamellia-128-ecbcamellia-256-cbccamellia-192-cbccamellia-128-cbccamellia-128-cbc-ctscamellia-128-cbc-ctscamellia-192-cbc-ctscamellia-192-cbc-ctscamellia-256-cbc-ctscamellia-256-cbc-ctscamellia-256-ofbcamellia-192-ofbcamellia-128-ofbcamellia-256-cfbcamellia-192-cfbcamellia-128-cfbcamellia-256-cfb1camellia-256-cfb1camellia-192-cfb1camellia-192-cfb1camellia-128-cfb1camellia-128-cfb1camellia-256-cfb8camellia-256-cfb8camellia-192-cfb8camellia-192-cfb8camellia-128-cfb8camellia-128-cfb8camellia-256-ctrcamellia-192-ctrcamellia-128-ctr1.2.156.10197.1.104.81.2.156.10197.1.104.91.2.156.10197.1.104.10chacha20-poly1305chacha20-poly1305sha-1sha1sha-224sha-256sha-384sha-512ripemdrmd160nulled25519ed448ecdsaecdsahmachmacsiphashsiphashu_n_kr" - Source: "00000000-00005992.00000001.171920.003E0000.00000004.mdmp") Found URL "http://ocsp.r2m02.amazontrust.com06*http://crt.r2m02.amazontrust.com/r2m02.cer0nzi" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.roovn.antrust.com/rootca1.cer0?80604.http://crl.rootca1.amazontrust.com/rootca1.crl0@3" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0b7b\chlw91_" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found URL "http://o.ss2.us/0!http://x.ss2.us/x.cer0&http://s.ss2.us/r.crl0sn>g]4(kvny_" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found URL "http://crl.rootca1.amazontrust.com/rootca1.crlamazon1amazon" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found URL "http://ocsp.r2m02.amazontrust.com06*http://crt.r2m02.amazontrust.com/r2m02.cersubjectpublickeyinfoazon" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cer0?80604.http://crl.rootca1.amazontrust.com/rootca1.crl0pt" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cerb]ruz;@1j$8a%%nzi" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found URL "http://crl.r2m02.amazontrust.com/r2m02.crl0ui0g0-!http://ocsp.r2m02.amazontrust.com06*http://crt.r2m02.amazontrust.com/r2m02.cer0nzi" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0wn59wn0-wnlzwn^own^iwn?@wnlzwn^own^iwn?@tp://s.ss2.us/r.crl1.2.840.113549.1.5.12arizona1scottsdale1%0" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp") Found URL "http://o.ss2.us/0!http://x.ss2.us/x.cer0&http://s.ss2.us/r.crl0wnus%bw+s.124.12.162truewn@,)jq[wnqr%bw+s\windows\system32\rsaenh.dll:status1.3.6.1.4.1.1722.12.2.11.3.6.1.4.1.1722.12.2.22.16.840.1.101.3.4.2.192.16.840.1.101.3.4.2.20krb5kdfargon2iargon2iargon2dargon2dcmacgmacgmachmackmac128wn*" - Source: "00000000-00005992.00000001.171920.0047A000.00000004.mdmp")31:T788,"random.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\Windows\Recent\* (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter All Control Panel Items.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter Appearance and Personalization.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter AutomaticDestinations (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter CustomDestinations (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter Database1.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter desktop.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter Display.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter Downloads.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter Hardware and Sound.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter Network and Internet.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter Programs.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter pythonLibrary.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter slowfuzzer.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter System and Security.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter VxFuzzer.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter Win7-KB3191566-x86.lnk (UID: 00000000-00005992) "random.exe" called "FindNextFileW" with parameter Win7-KB3191566-x86.msu.lnk (UID: 00000000-00005992)32:T960,"random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d98deedd3f4e5ead06704ad629f473ab908d7522f1a81dfb0bd2d423f18f814d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1791130947001,"unified_at":"2026-10-04T16:22:27.001Z","metadata":{"hashes":{"sha256":"d98deedd3f4e5ead06704ad629f473ab908d7522f1a81dfb0bd2d423f18f814d","sha1":"8ec369f0b04dc404236cc6413aae7b1f4741e369","md5":"6c4c61c48a26ede8f3f90ecff53a580e","sha512":"41012f90a873ad791344cd53fdda100896f70fd03d0e4006ca818ae6c53252868178dd6cb3a62365ee897a5806c924e2a2f310b42b4daee0ddb723182a66e50e","ssdeep":"98304:kib/spd18u8dLcoH4kR5x0FxrwVQsPIvLfQvU:V+J8dv4kV0T2gvLfQs","ssdeep_chunks":["98304:kib/spd","98304:ib/spd1","98304:b/spd18","98304:/spd18u","98304:spd18u8","98304:pd18u8d","98304:d18u8dL","98304:18u8dLc","98304:8u8dLco","98304:u8dLcoH","98304:8dLcoH4","98304:dLcoH4k","98304:LcoH4kR","98304:coH4kR5","98304:oH4kR5x","98304:H4kR5x0","98304:4kR5x0F","98304:kR5x0Fx","98304:R5x0Fxr","98304:5x0Fxrw","98304:x0FxrwV","98304:0FxrwVQ","98304:FxrwVQs","98304:xrwVQsP","98304:rwVQsPI","98304:wVQsPIv","98304:VQsPIvL","98304:QsPIvLf","98304:sPIvLfQ","98304:PIvLfQv","98304:IvLfQvU","196608:kib/spd","196608:ib/spd1","196608:b/spd18","196608:/spd18u","196608:spd18u8","196608:pd18u8d","196608:d18u8dL","196608:18u8dLc","196608:8u8dLco","196608:u8dLcoH","196608:8dLcoH4","196608:dLcoH4k","196608:LcoH4kR","196608:coH4kR5","196608:oH4kR5x","196608:H4kR5x0","196608:4kR5x0F","196608:kR5x0Fx","196608:R5x0Fxr","196608:5x0Fxrw","196608:x0FxrwV","196608:0FxrwVQ","196608:FxrwVQs","196608:xrwVQsP","196608:rwVQsPI","196608:wVQsPIv","196608:VQsPIvL","196608:QsPIvLf","196608:sPIvLfQ","196608:PIvLfQv","196608:IvLfQvU","98304:V+J8dv4","98304:+J8dv4k","98304:J8dv4kV","98304:8dv4kV0","98304:dv4kV0T","98304:v4kV0T2","98304:4kV0T2g","98304:kV0T2gv","98304:V0T2gvL","98304:0T2gvLf","98304:T2gvLfQ","98304:2gvLfQs"],"imphash":"2eabe9054cad5152567f0699947a2c5b"},"file_info":{"file_name":"random.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4456448,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1733023213000,"last_seen":1733030688000,"last_multi_scan":1733030688000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":["evasive"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":37},"sandbox_signatures":{"informative_count":78,"suspicious_count":16,"malicious_count":2,"total":96},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.TPM.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.568294","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.HZB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:TrojanSpy/Stealer.ay","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_43.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Queries process information"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains reference to Sysinternals URL"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","identifiers":[{"type":"suspicious","value":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","sources":[{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Reads the hosts file"}],"sources":[{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000324.00000000.234396.04090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"random.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.985748502974784","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000324-00000C29-2672820097\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"random.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000324)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"random.exe\" called \"IsWow64Process\" with parameter \"324\" - (UID: 00000000-00000324)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"random.exe\" called \"GetWindowTextA\" with parameter \"Blank page ?- Microsoft Edge\" - (UID: 00000000-00000324)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"random.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000324)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"random.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000324)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"random.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"random.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$26","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"lstrcpy\"; File: \"random.exe\")\n Found reference to API (Indicator: \"CryptAcquireContextA\"; File: \"random.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"ss Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00000324.00000000.234396.04090000.00000004.mdmp\")\n Found string \"Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00000324.00000000.234396.04090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"DBWinMutex\"\n \"SM0:324:168:WilStaging_02\"\n \"Local\\SM0:324:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"random.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74220000\n \"random.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72EA0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"random.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76AC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"random.exe\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"random.exe\" has an executable section named \"\"\n \"random.exe\" has an executable section named \"tphecgdh\"\n \"random.exe\" has an executable section named \"sdkkyvlc\"\n \"random.exe\" has an executable section named \".taggant\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"random.exe\" has an writable section named \"\"\n \"random.exe\" has an writable section named \".rsrc\"\n \"random.exe\" has an writable section named \".idata\"\n \"random.exe\" has an writable section named \"tphecgdh\"\n \"random.exe\" has an writable section named \"sdkkyvlc\"\n \"random.exe\" has an writable section named \".taggant\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$29","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"\" is \"0x283200\" greater than 0x100000\n Raw size of \"tphecgdh\" is \"0x1b9000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x74b000\" greater than 0x100000\n Virtual size of \"\" is \"0x389000\" greater than 0x100000\n Virtual size of \"tphecgdh\" is \"0x1b9000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"random.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"random.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"random.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 324 -ip 324\" (UID: 00000000-00004956)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 324 -s 788\" (UID: 00000000-00005336)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 324 -s 788\" (UID: 00000000-00007728)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 324 -ip 324\" (UID: 00000000-00004956)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 324 -s 788\" (UID: 00000000-00005336)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 324 -s 788\" (UID: 00000000-00007728)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 3113338)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"random.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"random.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"\"random.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"\"; Value: \"\")\n \"random.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"\"; Value: \"\")\n \"random.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")\n \"random.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")\n \"random.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")\n \"random.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"\"; Value: \"\")\n \"random.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")\n \"random.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"random.exe\" queries basic process information of the \"C:\\random.exe\" (UID: 324)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"random.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: The input sample possibly contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"random.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"random.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"random.exe\" trying to touch file \"C:\\random.exe\"\n \"random.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"random.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"random.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"random.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"random.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"random.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"random.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"random.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"\n \"random.exe\" trying to access non-existent file \"C:\\WINMM.DLL\"\n \"random.exe\" trying to access non-existent file \"C:\\winmm.dll\"\n \"random.exe\" trying to access non-existent file \"C:\\WINMMBASE.DLL\"\n \"random.exe\" trying to access non-existent file \"C:\\WINMMBASE.dll\"\n \"random.exe\" trying to access non-existent file \"C:\\BCRYPT.DLL\"\n \"random.exe\" trying to access non-existent file \"C:\\bcrypt.dll\"\n \"random.exe\" trying to access non-existent file \"C:\\IPHLPAPI.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"random.exe\" trying to access non-existent file \"C:\\RANDOM.EXE.LOCAL\"\n \"random.exe\" trying to access non-existent file \"C:\\random.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"+u.ci\"\n Heuristic match: \"5!.de\"\n Heuristic match: \"=4z.xn\"\n Heuristic match: \"k].gi\"\n Heuristic match: \"pb.ua\"\n Heuristic match: \"\\.top\"\n Heuristic match: \"].j;|<].cl\"\n Heuristic match: \"0''g.co\"\n Pattern match: \"www.sysinternals.com\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"random.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"random.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"random.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"AEs~*\" (Indicator: \"aes\"; File: \"random.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"random.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000324.00000000.234396.04090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"random.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"random.exe\" has section name with entropy \"7.9873738703\"\n \"random.exe\" has section name .rsrc with entropy \"6.11030262401\"\n \"random.exe\" has section name tphecgdh with entropy \"7.95535169506\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"random.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"random.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"random.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00000324)\n \"random.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00000324)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"random.exe\" claimed CRC 4475390 while the actual is CRC 4482236","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"random.exe\" has an entrypoint in section \".taggant\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"random.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"random.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"674bf304c42648feb40445ca"},{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"},{"report_type":"sandbox","report_id":"674bf320dc8229c4d10f3f5d"},{"report_type":"sandbox","report_id":"674bf314a8d9689bce00e6cb"},{"report_type":"sandbox","report_id":"674bf31a5e81e3783c0d2d32"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"random.exe\" is setting 'ThreadHideFromDebugger' data for its current thread","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"random.exe queries ProcessDebugPort (UID: 5724)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"674bf30d2a0b2f06050500f6"}]},{"level":"suspicious","category":"Network Related","name":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)","description":"Found more than 2 POST requests like this POST /RST2.srf HTTP/1.0Connection: Keep-Alive\n Content-Type: application/soap+xml\n Accept: */*\n User-Agent: MSAWindows/45 (OS 10.0.22621.0.0 ni_release; IDK 10.0.22621.1 ni_release; Cfg 16.000.29325.00; Test 0)\n Content-Length: 4694\n Host: login.live.com\n with payload ==>