24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample dcde2a73b6f2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample dcde2a73b6f2…. Malware family: Zusy.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dcde2a73b6f201582bc32d96780a29ea227f488b7436754e6e709bbe755920f3","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","dcde2a73b6f201582bc32d96780a29ea227f488b7436754e6e709bbe755920f3"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"dcde2a73b6f201582bc32d96780a29ea227f488b7436754e6e709bbe755920f3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":13,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tc42,"file.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000cf00e8a80701e8a807010000000009508e770000ef760300000006518e770000000090eccf003429af76000000000000000000000000000000002048af7608000000000000005013f3763429af760000000008000000e8a807010000000000000000000000000000000018000000019254a2a3835b73a8fdce0074eccf0008edcf0040b15b731d07c6d1feffffff94fc9277d89c0701000006010000000000000000c3915a737ceccf00000000006400000026002b0030510601000000002b00000000000000f0950701d79c0701d89c0701205106010000060174eccf005ceccf00a6eb8e77000000000000000000000000b047af768a9d4e1794eccf00 (UID: 00000000-00008224) "file.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008224) "file.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008224) "file.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000701b42fab0000eecf00650993771200000000000000d06c747702000000805f0701b42fab0020eecf00650993771200000000000000d06c7477f0b92d761200000034eecf00ae2e90770200000000000000d06c747744eecf00e16c747702000000000000006ceecf006820da7602000000000000003737b1867092357600000000aceecf00201bdf76ffffffffbceecf005810da763c10da76e737b186709235769cb92d76f0b92d769ceecf0098eecf000d0000000d000000504151767cc88a760000000040415176b8eecf0030efcf00608ddd7613cc98f0feffffffc8eecf00900fda7650415176d8eecf00062544767cc88a7650415176e4eecf00 (UID: 00000000-00008224) "file.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008224)26:T4ec,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00008224) "file.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00008224)27:T132f,"file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008224) "file.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00008224)28:T1cde,Found reference to API (Indicator: "lstrcpy"; File: "file.exe") Found reference to API (Indicator: "CreateThread"; File: "file.exe") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "SetThreadGroupAffinity"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00008224.00000000.395256.00081000.00000040.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00008224.00000000.395256.000EB000.00000040.mdmp") Found reference to API (Indicator: "OpenSCManagerA"; Source: "00000000-00008224.00000000.395256.00262000.00000040.mdmp") Found reference to API (Indicator: "CreateServiceA"; Source: "00000000-00008224.00000000.395256.00262000.00000040.mdmp") Found reference to API (Indicator: "StartServiceA"; Source: "00000000-00008224.00000000.395256.00262000.00000040.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00008224.00000000.395256.00262000.00000040.mdmp") Found reference to API (Indicator: "OpenServiceA"; Source: "00000000-00008224.00000000.395256.00262000.00000040.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00008224.00000000.395256.00262000.00000040.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00008224.00000000.395256.00262000.00000040.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00008224.00000000.395256.00262000.00000040.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00008224.00000000.395256.00262000.00000040.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00008224.00000000.395256.002F6000.00000040.mdmp")29:T524,"file.exe" loaded module "KERNEL32" at base 76b20000 "file.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77610000 "file.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77610000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77610000 "file.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77430000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77610000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77610000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77610000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73540000 "file.exe" loaded module "USER32.DLL" at base 75f90000 "file.exe" loaded module "ADVAPI32.DLL" at base 755b0000 "file.exe" loaded module "NTDLL.DLL" at base 778a0000 "file.exe" loaded module "WINMM.DLL" at base 75550000 "file.exe" loaded module "NTDLL" at base 778a0000 "file.exe" loaded module "KERNEL32.DLL" at base 76b20000 "file.exe" loaded module "SHELL32.DLL" at base 762b0000 "file.exe" loaded module "OLE32.DLL" at base 769a0000 "file.exe" loaded module "WININET.DLL" at base 74e70000 "file.exe" loaded module "WS2_32.DLL" at base 761a0000 "file.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 76b200002a:T491,"file.exe" file has an entrypoint instructions - "jmp 0x71300a,paddb mm6, qword ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add cl, ch,add byte ptr [eax], ah,add byte ptr [eax], al,add byte ptr [ebx], al,or al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], dh,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax + eax], ah,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,and dword ptr [eax], eax,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add ecx, dword ptr [edx],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2b:T7e1,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2c:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003896.00000000.227064.03230000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003896.00000000.227064.03230000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003896.00000000.227064.03230000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003896.00000000.227064.03230000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003896.00000000.227064.03230000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003896.00000000.227064.03230000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003896.00000000.227064.03230000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003896.00000000.227064.03230000.00000004.mdmp")2d:T558,"file.exe" called "LoadResource with parameter {'hModule': '1988231168', 'hResInfo': '12406296'}" (UID: 00000000-00004720) "file.exe" called "LoadResource with parameter {'hModule': '2007891968', 'hResInfo': '12781040'}" (UID: 00000000-00004720) "file.exe" called "LoadResource with parameter {'hModule': '1988231168', 'hResInfo': '1992331296'}" (UID: 00000000-00004720) "file.exe" called "LoadResource with parameter {'hModule': '1988231168', 'hResInfo': '12409000'}" (UID: 00000000-00004720) "file.exe" called "LoadResource with parameter {'hModule': '1988231168', 'hResInfo': '12409016'}" (UID: 00000000-00004720) "file.exe" called "LoadResource with parameter {'hModule': '1988231168', 'hResInfo': '12409048'}" (UID: 00000000-00004720) "file.exe" called "LoadResource with parameter {'hModule': '1988231168', 'hResInfo': '12412152'}" (UID: 00000000-00004720) "file.exe" called "LoadResource with parameter {'hModule': '1988231168', 'hResInfo': '12412072'}" (UID: 00000000-00004720) "file.exe" called "LoadResource with parameter {'hModule': '1988231168', 'hResInfo': '12412136'}" (UID: 00000000-00004720) "file.exe" called "LoadResource with parameter {'hModule': '1988231168', 'hResInfo': '1992330608'}" (UID: 00000000-00004720) "file.exe" called "LoadResource with parameter {'hModule': '1988231168', 'hResInfo': '1992373856'}" (UID: 00000000-00004720)2e:T467,"file.exe" trying to access non-existent file "SICE" "file.exe" trying to access non-existent file "SIWVID" "file.exe" trying to access non-existent file "NTICE" "file.exe" trying to access non-existent file "C:\file.exe.Local\" "file.exe" trying to access non-existent file "C:\Windows\Tasks\skotes.job" "file.exe" trying to access non-existent file "C:\Users\faPSbQA\AppData\Local\Temp\abc3bc1985" "file.exe" trying to access non-existent file "C:\Users\faPSbQA\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier" "file.exe" trying to access non-existent file "C:\FILE.EXE.LOCAL" "file.exe" trying to access non-existent file "C:\Windows\Tasks\SKOTES.JOB" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ABC3BC1985" "file.exe" trying to access non-existent file "C:\DESKTOP.INI" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\abc3bc1985\skotes.exe:ZONE.IDENTIFIER" "skotes.exe" trying to access non-existent file "SICE" "skotes.exe" trying to access non-existent file "SIWVID" "skotes.exe" trying to access non-existent file "NTICE"2f:T41e,"file.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1090587231" "cx": "416" "cy": "30"} "file.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "453052880" "cx": "16" "cy": "16"} "file.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "620823101" "cx": "416" "cy": "30"} "file.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "469829739" "cx": "1" "cy": "1"} "file.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "520161385" "cx": "1" "cy": "1"} "file.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "453052880" "cx": "416" "cy": "30"} "file.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "453052880" "cx": "355" "cy": "15"} "file.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1090587231" "cx": "355" "cy": "15"} "file.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "620823101" "cx": "355" "cy": "15"} "file.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "453052880" "cx": "400" "cy": "163"}30:T7ce,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000956-11407-1328-01084620 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000956-11407-1328-01084620 Assembly shows XOR instruction xor dword ptr [esp+04h] ebp in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor esi 36C7830Fh in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor eax dword ptr [esp] in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor dword ptr [esp+04h] eax in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor dword ptr [esp+04h] esi in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor ebp B66E8380h in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor esi F4614B85h in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor eax 6FE7430Ah in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor edi 77B68022h in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor ebx ebp in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor dword ptr [esp] ecx in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor ecx dword ptr [esp] in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor ecx 5D9FE0B8h in Stream UID: 00000000-00000956-11407-4236-010B00FE Assembly shows XOR instruction xor ebx 8030012Eh in Stream UID: 00000000-00000956-11407-4236-010B00FE1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"dcde2a73b6f201582bc32d96780a29ea227f488b7436754e6e709bbe755920f3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790949679545,"unified_at":"2026-10-02T14:01:19.545Z","metadata":{"hashes":{"sha256":"dcde2a73b6f201582bc32d96780a29ea227f488b7436754e6e709bbe755920f3","sha1":"40dc766067545343481cdf8180dbcf73b5199bdb","md5":"ebf55eb4c7b5fca83338793ebb9ec03a","sha512":"7284d6bec7babefd6fe5fb40f20b11576edd7e3043c4994579151a4e9bc14d9b8b232fea8731db62cacc212a0a88a55938ae0f9bc7616926946b95972ee0e871","ssdeep":"49152:XYtjLv3Obz2AMgy4AGul7HdzmbfTx4feH:I/3Az2AMg1Anl7HcbfTx42","ssdeep_chunks":["49152:XYtjLv3","49152:YtjLv3O","49152:tjLv3Ob","49152:jLv3Obz","49152:Lv3Obz2","49152:v3Obz2A","49152:3Obz2AM","49152:Obz2AMg","49152:bz2AMgy","49152:z2AMgy4","49152:2AMgy4A","49152:AMgy4AG","49152:Mgy4AGu","49152:gy4AGul","49152:y4AGul7","49152:4AGul7H","49152:AGul7Hd","49152:Gul7Hdz","49152:ul7Hdzm","49152:l7Hdzmb","49152:7Hdzmbf","49152:HdzmbfT","49152:dzmbfTx","49152:zmbfTx4","49152:mbfTx4f","49152:bfTx4fe","49152:fTx4feH","98304:XYtjLv3","98304:YtjLv3O","98304:tjLv3Ob","98304:jLv3Obz","98304:Lv3Obz2","98304:v3Obz2A","98304:3Obz2AM","98304:Obz2AMg","98304:bz2AMgy","98304:z2AMgy4","98304:2AMgy4A","98304:AMgy4AG","98304:Mgy4AGu","98304:gy4AGul","98304:y4AGul7","98304:4AGul7H","98304:AGul7Hd","98304:Gul7Hdz","98304:ul7Hdzm","98304:l7Hdzmb","98304:7Hdzmbf","98304:HdzmbfT","98304:dzmbfTx","98304:zmbfTx4","98304:mbfTx4f","98304:bfTx4fe","98304:fTx4feH","49152:I/3Az2A","49152:/3Az2AM","49152:3Az2AMg","49152:Az2AMg1","49152:z2AMg1A","49152:2AMg1An","49152:AMg1Anl","49152:Mg1Anl7","49152:g1Anl7H","49152:1Anl7Hc","49152:Anl7Hcb","49152:nl7Hcbf","49152:l7HcbfT","49152:7HcbfTx","49152:HcbfTx4","49152:cbfTx42"],"imphash":"2eabe9054cad5152567f0699947a2c5b"},"file_info":{"file_name":"file.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3218944,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1731085516000,"last_seen":1731734305000,"last_multi_scan":1731734305000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":62},"sandbox_signatures":{"informative_count":112,"suspicious_count":13,"malicious_count":7,"total":132},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.TPM.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.545677","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.545677 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.HZB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00585f781 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TPM.kthyja","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Amadey-D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.JDU.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.WYX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_31.9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"malicious","value":"Calls an API typically used to execute an application"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"suspicious","value":"Spawned processes likely due to injection"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify virtual environment using sandbox registry"},{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains reference to Sysinternals URL"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","identifiers":[{"type":"suspicious","value":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Loads the task scheduler interface DLL"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"file.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found reference to API \"OpenService API Error while extraction the driver\" (Indicator: \"OpenService\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\SICE; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string - \\\\.\\SIWVID; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string - \\\\.\\NTICE; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string - \\\\.\\oreans32; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string - \\\\.\\Global\\oreans32; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string - \\\\.\\Global\\oreansx64; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string - \\\\.\\Oreans.vxd; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008224-00000C29-5181138454\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using sandbox registry","description":"Found string \"HARDWARE\\ACPI\\DSDT\\VBOX__\" (Indicator: \"hardware\\acpi\\dsdt\\vbox__\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string \"Software\\Wine\" (Indicator: \"software\\wine\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-668","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"file.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008224)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"file.exe\" called \"IsWow64Process\" with parameter \"8224\" - (UID: 00000000-00008224)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"file.exe\" called \"GetWindowTextA\" with parameter \"Program Manager\" - (UID: 00000000-00008224)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008224)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"file.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008224)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found reference to API \"OpenSCManager API Error while extraction the driver\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"file.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$26","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found reference to API \"CloseServiceHandle API Error while extraction the driver\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 2446129)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"file.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found reference to API \"StartService API Error while extraction the driver\" (Indicator: \"StartService\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"ss Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00008224.00000000.395256.01060000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\WinLicense\" in Source: 00000000-00008224.00000000.395256.00262000.00000040.mdmp\n \"Software\\WLkt\" in Source: 00000000-00008224.00000000.395256.00262000.00000040.mdmp\n \"Software\\Wine\" in Source: 00000000-00008224.00000000.395256.00262000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"DBWinMutex\"\n \"Local\\SM0:8224:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75ED0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file.exe\" has an executable section named \"\"\n \"file.exe\" has an executable section named \"puwplpfb\"\n \"file.exe\" has an executable section named \"chfezqgl\"\n \"file.exe\" has an executable section named \".taggant\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file.exe\" has an writable section named \"\"\n \"file.exe\" has an writable section named \".rsrc\"\n \"file.exe\" has an writable section named \".idata\"\n \"file.exe\" has an writable section named \"puwplpfb\"\n \"file.exe\" has an writable section named \"chfezqgl\"\n \"file.exe\" has an writable section named \".taggant\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2a","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"puwplpfb\" is \"0x2a6200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"puwplpfb\" is \"0x2a7000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 92 -p 8224 -ip 8224\" (UID: 00000000-00001888)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8224 -s 712\" (UID: 00000000-00007684)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8224 -s 712\" (UID: 00000000-00004980)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 92 -p 8224 -ip 8224\" (UID: 00000000-00001888)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8224 -s 712\" (UID: 00000000-00007684)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8224 -s 712\" (UID: 00000000-00004980)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"file.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found reference to API \"CreateService API Error while extraction the driver\" (Indicator: \"CreateService\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"\"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CODEPAGE\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\STATESEPARATION\\REDIRECTIONMAP\\KEYS\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 8224)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"file.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment using sandbox registry","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\file.exe\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"file.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"file.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rpcrt4.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ws2_32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"file.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\winmm.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\WININET.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"&y.mq\"\n Heuristic match: \"4$.kr\"\n Heuristic match: \"-a.gn\"\n Pattern match: \"www.sysinternals.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"file.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")\n Found reference to API \"GetCurrentProcessorNumberEx\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable API Error while extraction the driver\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"%s\\system32\\drivers\\%s\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string \"%s\\system32\\drivers\\%s\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string \"%s\\syswow64\\drivers\\%s\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string \"%s\\system32\\drivers\\oreans32.sys\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string \"%s\\system32\\drivers\\oreans32.sys\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00008224.00000000.395256.01060000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00008224.00000000.395256.01060000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00008224.00000000.395256.00262000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008224.00000000.395256.00081000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"file.exe\" has section name with entropy \"7.15151175905\"\n \"file.exe\" has section name puwplpfb with entropy \"6.44404740395\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"info@oreans.com\"\n Pattern match: \"yoursite@yoursite.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"level":"suspicious","category":"Network Related","name":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)","description":"Found more than 2 POST requests like this POST /RST2.srf HTTP/1.0Connection: Keep-Alive\n Content-Type: application/soap+xml\n Accept: */*\n User-Agent: MSAWindows/45 (OS 10.0.22621.0.0 ni_release; IDK 10.0.22621.1 ni_release; Cfg 16.000.29325.00; Test 0)\n Content-Length: 4694\n Host: login.live.com\n with payload ==> \" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003896.00000000.227064.03230000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"3024,,RtlGetVersion,NTDLL.dll,\"00:59:04.437\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00003896.00000000.227064.03230000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74E10000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"3024,,RtlGetVersion,NTDLL.dll,\"00:59:04.437\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003896.00000000.227064.03230000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"file.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00004720)\n \"file.exe\" called \"FindResourceW\" with parameter \"42\" - (UID: 00000000-00004720)\n \"file.exe\" called \"FindResourceW\" with parameter \"69138724\" - (UID: 00000000-00004720)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"file.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00004720)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"file.exe\" called \"LookupAccountSidW\" with param Name faPSbQA (UID: 00000000-00004720)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"file.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004720)\n \"file.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00004720)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"skotes.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"file.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FILE.EXE\")\n \"file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FILE.EXE\")\n \"file.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SKOTES.EXE\")\n \"file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SKOTES.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"file.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\abc3bc1985 (UID: 00000000-00004720)\n \"file.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00004720)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"file.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\abc3bc1985\\skotes.exe\"\" - (UID: 00000000-00004720)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"3746346371728,3892,3182,,ShellExecuteA,Shell32.dll,\"252:50:11.156\",RX=0,PX=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004720.00000001.156916.00595000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00004720.00000001.156916.00595000.00000004.mdmp\n \"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00004720.00000001.156916.00595000.00000004.mdmp\n \":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00004720.00000001.156916.00595000.00000004.mdmp\n \":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00004720.00000001.156916.00595000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"file.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"file.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"file.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2\" - [base:0; Status:c0000135]\n \"skotes.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"skotes.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"skotes.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0a000b00cc191574@ADVAPI32.dll\"\n \"0d000e00bc191574@ADVAPI32.dll\"\n \"0f001000ac191574@ADVAPI32.dll\"\n \"0f0010008c06be76@DUI70.dll\"\n \"15001600c02e656c@ADVAPI32.dll\"\n \"0e000f00702f656c@ADVAPI32.dll\"\n \"0e000f00cc2f656c@ADVAPI32.dll\"\n \"11001200b437656c@ADVAPI32.dll\"\n \"110012004838656c@ADVAPI32.dll\"\n \"120013008c38656c@ADVAPI32.dll\"\n \"12001300e438656c@ADVAPI32.dll\"\n \"14001500385e656c@ADVAPI32.dll\"\n \"14001500505e656c@ADVAPI32.dll\"\n \"14001500685e656c@ADVAPI32.dll\"\n \"17001800805e656c@ADVAPI32.dll\"\n \"0d000e00985e656c@ADVAPI32.dll\"\n \"11001200a85e656c@ADVAPI32.dll\"\n \"11001200bc5e656c@ADVAPI32.dll\"\n \"0d000e004456656c@WININET.dll\"\n \"0d000e00b456656c@WININET.dll\"\n \"10001100ec56656c@WININET.dll\"\n \"100011009057656c@WININET.dll\"\n \"10001100005f656c@WININET.dll\"\n \"10001100145f656c@WININET.dll\"\n \"14001500285f656c@WININET.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"file.exe\" touched \"Search Gatherer Notification\" (Path: \"HKCU\\CLSID\\{9E175B6D-F52A-11D8-B9A5-505054503030}\\LOCALSERVER32\")\n \"file.exe\" touched \"Scheduling Agent Service Class\" (Path: \"HKCU\\CLSID\\{148BD52A-A2AB-11CE-B11F-00AA00530503}\")\n \"file.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"file.exe\" touched \"Progress Dialog\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{F8383852-FCD3-11D1-A6B9-006097DF5BD4}\")\n \"file.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")\n \"file.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")\n \"file.exe\" touched \"Security Manager\" (Path: \"HKCU\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")\n \"file.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00004720-00000C28-1454361182]\n Observed system executable string:\"%WINDIR%\\system32\\DUser.dll\" [Source: 00000000-00004720-00000C28-1459939080]\n Observed system executable string:\"%WINDIR%\\system32\\xmllite.dll\" [Source: 00000000-00004720-00000C28-1460679059]\n Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00004720-00000C28-1463387505]\n Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00004720-00000C28-1463772819]\n Observed system executable string:\"%WINDIR%\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\gdiplus.dll\" [Source: 00000000-00004720-00000C28-1464024117]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"file.exe\" searching for class \"OLLYDBG\"\n \"file.exe\" searching for class \"GBDYLLO\"\n \"file.exe\" searching for class \"pediy06\"\n \"file.exe\" searching for class \"FilemonClass\"\n \"file.exe\" searching for window \"File Monitor - Sysinternals: www.sysinternals.com\"\n \"file.exe\" searching for class \"PROCMON_WINDOW_CLASS\"\n \"file.exe\" searching for window \"Process Monitor - Sysinternals: www.sysinternals.com\"\n \"file.exe\" searching for class \"RegmonClass\"\n \"file.exe\" searching for window \"Registry Monitor - Sysinternals: www.sysinternals.com\"\n \"file.exe\" searching for class \"18467-41\"\n \"file.exe\" searching for class \"Regmonclass\"\n \"file.exe\" searching for class \"Filemonclass\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"file.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\abc3bc1985\\skotes.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"file.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"skotes.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\abc3bc1985\\skotes.exe]- [targetUID: 00000000-00004720]\n \"skotes.job\" has type \"VAX-order 68k Blit mpx/mux executable\"- Location: [%WINDIR%\\Tasks\\skotes.job]- [targetUID: 00000000-00004720]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"file.exe\" touched file \"C:\\Windows\\Tasks\\skotes.job\"\n \"file.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"file.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"file.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"file.exe\" writes file \"c:\\windows\\tasks\\skotes.job\"\n \"file.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\abc3bc1985\\skotes.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"file.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004720)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004720.00000001.156916.00595000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$2f","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"file.exe\" called \"FindFirstFileW\" with parameter %TEMP%\\abc3bc1985\\*.* (UID: 00000000-00004720)\n \"file.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00004720)\n \"file.exe\" called \"FindNextFileW\" with parameter skotes.exe (UID: 00000000-00004720)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"file.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"LDAPCLIENTINTEGRITY\"; Value: \"\")\n \"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEOLDHOSTRESOLUTIONORDER\"; Value: \"\")\n \"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEHOSTNAMEASALIAS\"; Value: \"\")\n \"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"IPV4LOOPBACKALTERNATIVE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"skotes.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\abc3bc1985\\skotes.exe]- [targetUID: 00000000-00004720]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"file.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"skotes.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\abc3bc1985\\skotes.exe]- [targetUID: 00000000-00004720]\n \"skotes.job\" has type \"VAX-order 68k Blit mpx/mux executable\"- Location: [%WINDIR%\\Tasks\\skotes.job]- [targetUID: 00000000-00004720]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"%TEMP%\\abc3bc1985\\skotes.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"skotes.exe\" called \"LookupAccountNameA\" with parameters {\"AccountName\": \"faPSbQA\"\n \"Sid\": \"3270444\"\n \"cbSid\": \"ff000000\"\n \"cchReferencedDomainName\": \"ff000000\"\n \"peUse\": \"00000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"file.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"file.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"file.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\abc3bc1985\\skotes.exe (UID: 00000000-00004720)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"file.exe\" allocated memory in \"C:\\file.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"file.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\abc3bc1985\\skotes.exe\" (Handle: 772)\n \"file.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\abc3bc1985\\skotes.exe\" (Handle: 772)\n \"file.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\abc3bc1985\\skotes.exe\" (Handle: 772)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"56,3147,,IsWow64Process,kern\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000956.00000001.239458.00559000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00000000-00000956-11407-5988-0127D807","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"VAX-order 68k Blit mpx/mux executable\" was dropped at \"%WINDIR%\\Tasks\\skotes.job\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler interface DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\System32\\mstask.dll\" at 73E30000","origin":"Loaded Module","mitre_attack_id":"T1053","relevance":5,"id":"module-5","sources":[{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":11,"imported_dlls_count":81,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Sample Crashed","Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"67382b20984ba7eb5d03c0dc","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"file.exe","analysis_start_time":"2024-11-16T05:18:25+00:00","indicators_count":{"informative":24,"suspicious":5,"malicious":1},"tags":["Sample Crashed"],"is_in_unified_schema":true},{"id":"67382b1a7c8b012d8e09ce68","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"file.exe","analysis_start_time":"2024-11-16T05:18:19+00:00","indicators_count":{"informative":101,"suspicious":31,"malicious":6},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"67382b135121440d190cca31","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"file.exe","analysis_start_time":"2024-11-16T05:29:16+00:00","indicators_count":{"informative":98,"suspicious":30,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"67382b0c45db7a495f02b540","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"file.exe","analysis_start_time":"2024-11-16T05:18:06+00:00","indicators_count":{"informative":70,"suspicious":15,"malicious":2},"tags":["Sample Crashed"],"is_in_unified_schema":true},{"id":"67382b04ba6b1a26920f14f3","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"file.exe","analysis_start_time":"2024-11-16T05:17:57+00:00","indicators_count":{"informative":77,"suspicious":14,"malicious":2},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"}],"processes":[{"pid":8224,"ppid":0,"name":"file.exe","command_line":"","sha256":"dcde2a73b6f201582bc32d96780a29ea227f488b7436754e6e709bbe755920f3","normalized_path":"C:\\file.exe","uid":"00000000-00008224","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":7684,"ppid":8224,"name":"WerFault.exe","command_line":"-u -p 8224 -s 712","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008224","uid":"00000000-00007684"},{"pid":4980,"ppid":8224,"name":"WerFault.exe","command_line":"-u -p 8224 -s 712","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008224","uid":"00000000-00004980"},{"pid":1888,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 92 -p 8224 -ip 8224","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001888","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"}],"all_imported_dlls":["wow64con.dll","rpcrt4.dll","winmm.dll","ntdll.dll","fltLib.dll","sechost.dll","kernel32.dll","apphelp.dll","user32.dll","gdi32.dll","gdi32full.dll","shell32.dll","wow64.dll","wow64win.dll","ucrtbase.dll","combase.dll","wow64base.dll","msvcp_win.dll","wininet.dll","wow64cpu.dll","KernelBase.dll","ole32.dll","oleaut32.dll","cryptsp.dll","VxSSL32.dll","ws2_32.dll","msvcrt.dll","win32u.dll","advapi32.dll","imm32.dll","powrprof.dll","profapi.dll","cryptbase.dll","sspicli.dll","winmmbase.dll","cfgmgr32.dll","bcryptprimitives.dll","SHCore.dll","shlwapi.dll","kernel.appcore.dll","windows.storage.dll","nsi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","Wldap32.dll","rsaenh.dll","comctl32.dll","oleacc.dll","mpr.dll","ExplorerFrame.dll","version.dll","api-ms-win-core-synch-l1-2-0.dll","normaliz.dll","propsys.dll","clbcatq.dll","mstask.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","iertutil.dll","dwmapi.dll","usp10.dll","rpcss.dll","devobj.dll","uxtheme.dll","setupapi.dll","ntmarta.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","urlmon.dll","dui70.dll","msctf.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","xmllite.dll","oleaccrc.dll","userenv.dll","RpcRtRemote.dll","lpk.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","duser.dll","GdiPlus.dll","secur32.dll","shellstyle.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"skotes.exe","sha256":"dcde2a73b6f201582bc32d96780a29ea227f488b7436754e6e709bbe755920f3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"name":"skotes.job","sha256":"f3b07462a5fcf2e0260ff5263dcb629f546118103f22ba8bec0c7ff38a2cfa93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b20984ba7eb5d03c0dc"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"path":"%WINDIR%\\Tasks\\skotes.job","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"path":"%TEMP%\\abc3bc1985\\skotes.exe","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"},{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"},{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"name":"Local\\SM0:8224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67382b0c45db7a495f02b540"}]},{"name":"SM0:3896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"name":"Local\\SM0:3896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67382b04ba6b1a26920f14f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\006700e5a2ab05704bbb0c589b88924d","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]},{"name":"006700e5a2ab05704bbb0c589b88924d","sources":[{"report_type":"sandbox","report_id":"67382b135121440d190cca31"},{"report_type":"sandbox","report_id":"67382b1a7c8b012d8e09ce68"}]}]}},"report_ids":{"sandbox_job_ids":["67382b20984ba7eb5d03c0dc","67382b1a7c8b012d8e09ce68","67382b135121440d190cca31","67382b0c45db7a495f02b540","67382b04ba6b1a26920f14f3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Zusy.Generic Sample dcde2a73b6f2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample dcde2a73b6f2…. Malware family: Zusy.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dcde2a73b6f201582bc32d96780a29ea227f488b7436754e6e709bbe755920f3"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample dcde2a73b6f2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample dcde2a73b6f2…. Malware family: Zusy.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dcde2a73b6f201582bc32d96780a29ea227f488b7436754e6e709bbe755920f3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample dcde2a73b6f2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample dcde2a73b6f2…. Malware family: Zusy.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]