21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4d9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.MSILZilla Sample dbd4edd25881… — Score 81/100 — Hybrid Analysis","description":"Malicious verdict for sample dbd4edd25881…. Malware family: IL:Trojan.MSILZilla. Threat score 81/100. 10/26 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dbd4edd258813db2cac4abddb2a4230b62874591c09daa6ffbcd5c9022ebd042","keywords":["Malicious","IL:Trojan.MSILZilla","malware analysis","sandbox report","threat intelligence","dbd4edd258813db2cac4abddb2a4230b62874591c09daa6ffbcd5c9022ebd042"],"about":{"@type":"SoftwareApplication","name":"dbd4edd258813db2cac4abddb2a4230b62874591c09daa6ffbcd5c9022ebd042.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"dbd4edd258813db2cac4abddb2a4230b62874591c09daa6ffbcd5c9022ebd042","additionalType":"Malicious sample"},"threatScore":81,"malwareFamily":"IL:Trojan.MSILZilla","antivirusDetections":{"malicious":10,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T460,Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "dbd4edd258813db2cac4abddb2a4230b62874591c09daa6ffbcd5c9022ebd042.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004696.00000001.110353.00322000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004696.00000001.110353.00322000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004696.00000001.110353.00322000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00004696.00000001.110353.00322000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004696.00000001.110353.00322000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00004696.00000001.110353.00322000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00004696.00000001.110353.00322000.00000002.mdmp")23:T14f9,"" - Source: "00000000-00004696.00000001.110353.6F5C1000.00000020.mdmp")26:T66e,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp, 00000000-00004696.00000001.110353.6F5D5000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp, 00000000-00004696.00000001.110353.6F5D5000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp")27:Td0b,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004696-00000C2B-710837865] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004696-00000C2B-711171848] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004696-00000C2B-711276443] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004696-00000C2B-711334857] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004696-00000C2B-711510044] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004696-00000C2B-711538902] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004696-00000C2B-711597168] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004696-00000C2B-711679452] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00004696-00000C2B-711720810] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004696-00000C2B-711787663] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004696-00000C2B-711977489] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004696-00000C2B-712006566] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004696-00000C2B-712091987] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004696-00000C2B-712353467] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004696-00000C2B-712857166] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004696-00000C2B-713256830] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004696-00000C2B-713285759] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00004696-00000C2B-713313777] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004696-00000C2B-715375972] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00004696-00000C2B-715773350] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004696-00000C2B-716123075] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00004696-00000C2B-716404480]28:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00004696.00000001.110353.6F571000.00000002.mdmp")29:T577,"" (Indicator: "GetDC"; Source: "00000000-00004696.00000000.109812.02A20000.00000004.mdmp, 00000000-00004696.00000001.110353.02A20000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004696.00000000.109812.02A20000.00000004.mdmp, 00000000-00004696.00000001.110353.02A20000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004696.00000000.109812.02A20000.00000004.mdmp, 00000000-00004696.00000001.110353.02A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004696.00000000.109812.02A20000.00000004.mdmp, 00000000-00004696.00000001.110353.02A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004696.00000000.109812.02A20000.00000004.mdmp, 00000000-00004696.00000001.110353.02A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004696.00000000.109812.02A20000.00000004.mdmp, 00000000-00004696.00000001.110353.02A20000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004696.00000000.109812.02A20000.00000004.mdmp, 00000000-00004696.00000001.110353.02A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004696.00000000.109812.02A20000.00000004.mdmp, 00000000-00004696.00000001.110353.02A20000.00000004.mdmp")3a:Tad3,"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004696.00000000.109812.02A20000.00000004.mdmp, 00000000-00004696.00000001.110353.02A20000.00000004.mdmp\")","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699d69a428bb7e4bbd070fb2","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for encryption algorithm process \"00000000-00004696\"","id":"yara-208","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match – Encryption algorithm","origin":"YARA Signature","relevance":7,"sources":[{"report_id":"699d69a428bb7e4bbd070fb2","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00004696.00000001.110353.6F4E1000.00000020.mdmp, 00000000-00004696.00000001.110353.6F5C1000.00000020.mdmp\")\n Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00004696.00000001.110353.6F4E1000.00000020.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00004696.00000001.110353.6F4E1000.00000020.mdmp, 00000000-00004696.00000001.110353.6F5C1000.00000020.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00004696.00000001.110353.6F4E1000.00000020.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00004696.00000001.110353.6F4E1000.00000020.mdmp\")","id":"string-748","level":"informative","mitre_attack_id":"T1562.001","name":"Contains ability to disable Windows Defender using PowerShell","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699d69a428bb7e4bbd070fb2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004696.00000000.109812.02A20000.00000004.mdmp, 00000000-00004696.00000001.110353.02A20000.00000004.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699d69a428bb7e4bbd070fb2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004696-00000C2C-711333690\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004696-00000C2C-711334212\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004696.00000001.110353.6F571000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004696.00000001.110353.6F571000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004696.00000001.110353.6F571000.00000002.mdmp\")","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699d69a428bb7e4bbd070fb2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"