26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample e0002f6ce06c… — Score 92/100 — Hybrid Analysis","description":"Malicious verdict for sample e0002f6ce06c…. Malware family: Win/malicious_confidence_100%. Threat score 92/100. 10/27 AV engines flagged this file. 4 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3"],"about":{"@type":"SoftwareApplication","name":"e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin","applicationCategory":["peexe","executable"],"identifier":"e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3","additionalType":"Malicious sample"},"threatScore":92,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T623,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp")28:T969,Found string - \\.\DISPLAY1; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found string - \.\DISPLAY1; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp")29:Ta58,"" (Indicator: "GetDC"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp")3a:T4b5,Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "8153879076,7308,3025,,RtlGetNtProductType,NTDLL.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "78587564734,7404,3025,,RtlGetNtProductType,NTDLL.dll,"00:21:35.718",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006684.00000001.83050.02FA0000.00000004.mdmp") Found reference to API "40190779242,7404,3024,,RtlGetVersion,NTDLL.dll,"00:21:19.718",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006684.00000001.83050.02FA0000.00000004.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp")3b:T474,Found registry query API: "RegOpenKeyExW" in file "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin" Found registry query API: "RegQueryValueExW" in file "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin" Found registry query API: "RegEnumValueW" in file "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin" Found registry query API: "RegEnumKeyExW" in file "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin" Found registry query API: "RegQueryInfoKeyW" in file "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin" Found registry query API: "RegQueryValueExW" in "00000000-00006684.00000002.84971.0433A000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00006684.00000002.84971.0433A000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006684.00000002.84971.0433A000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00006684.00000002.84971.0433A000.00000004.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00006684.00000002.84971.0433A000.00000004.mdmp"3c:T4e6,Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp")3d:T1110,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "8144991410,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "8141579974,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "8143403086,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp") Found reference to API "8146336294,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "8152417032,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "8149822280,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "8145882916,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "8147751476,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "8151548536,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "8151972808,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "8150690122,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "8150256840,7308,3125,,Process32NextW,kernel32.dll,"00:21:06.375",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006684.00000000.81129.02FA0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp")3e:T1364,Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "78553966587,7404,111,,GetSystemMetrics,user32.dll,"00:21:35.703",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp") Found reference to API "78553701019,7404,111,,GetSystemMetrics,user32.dll,"00:21:35.703",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000001.83050.02FA0000.00000004.mdmp") Found reference to API "78554067609,7404,111,,GetSystemMetrics,user32.dll,"00:21:35.703",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000001.83050.02FA0000.00000004.mdmp") Found reference to API "78590607882,7404,111,,GetSystemMetrics,user32.dll,"00:21:35.718",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000001.83050.02FA0000.00000004.mdmp") Found reference to API "78554240713,7404,111,,GetSystemMetrics,user32.dll,"00:21:35.703",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000001.83050.02FA0000.00000004.mdmp") Found reference to API "78590423808,7404,111,,GetSystemMetrics,user32.dll,"00:21:35.718",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000001.83050.02FA0000.00000004.mdmp") Found reference to API "78554285557,7404,111,,GetSystemMetrics,user32.dll,"00:21:35.703",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000001.83050.02FA0000.00000004.mdmp") Found reference to API "40195939690,7404,111,,GetSystemMetrics,user32.dll,"00:21:19.718",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000001.83050.02FA0000.00000004.mdmp") Found reference to API "78590653318,7404,111,,GetSystemMetrics,user32.dll,"00:21:35.718",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000001.83050.02FA0000.00000004.mdmp") Found reference to API "154116570505,7404,111,,GetSystemMetrics,user32.dll,"00:22:07.187",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000002.84971.02FA0000.00000004.mdmp") Found reference to API "154079829775,7404,111,,GetSystemMetrics,user32.dll,"00:22:07.171",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000002.84971.02FA0000.00000004.mdmp") Found reference to API "154116642565,7404,111,,GetSystemMetrics,user32.dll,"00:22:07.187",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000002.84971.02FA0000.00000004.mdmp") Found reference to API "116504152171,7404,111,,GetSystemMetrics,user32.dll,"00:21:51.515",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000002.84971.02FA0000.00000004.mdmp") Found reference to API "154079167989,7404,111,,GetSystemMetrics,user32.dll,"00:22:07.171",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000002.84971.02FA0000.00000004.mdmp") Found reference to API "116542079213,7404,111,,GetSystemMetrics,user32.dll,"00:21:51.531",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000002.84971.02FA0000.00000004.mdmp") Found reference to API "116504197021,7404,111,,GetSystemMetrics,user32.dll,"00:21:51.515",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000002.84971.02FA0000.00000004.mdmp") Found reference to API "154079340981,7404,111,,GetSystemMetrics,user32.dll,"00:22:07.171",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000002.84971.02FA0000.00000004.mdmp") Found reference to API "154079535611,7404,111,,GetSystemMetrics,user32.dll,"00:22:07.171",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000002.84971.02FA0000.00000004.mdmp") Found reference to API "154116369961,7404,111,,GetSystemMetrics,user32.dll,"00:22:07.187",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000002.84971.02FA0000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "343418831591,7404,111,,GetSystemMetrics,user32.dll,"00:23:26.062",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found reference to API "343418490063,7404,111,,GetSystemMetrics,user32.dll,"00:23:26.062",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found reference to API "343418430387,7404,111,,GetSystemMetrics,user32.dll,"00:23:26.062",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000003.90472.02FA0000.00000004.mdmp") Found reference to API "343418538057,7404,111,,GetSystemMetrics,user32.dll,"00:23:26.062",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00006684.00000003.90472.02FA0000.00000004.mdmp")3f:T4cc,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp")40:T4dc,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006684.00000002.84971.0433A000.00000004.mdmp")41:T79c,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$28","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 7573-775-04651B30\n SetUnhandledExceptionFilter@KERNEL32.dll at 7573-1920-0465D4FF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Detected Suricata alert – Encrypted channel\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 181320; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 235955; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 236203; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 239797; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 240407; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 241609; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 87742; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 88361; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 168972; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 240396; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 241600; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; File: \"e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006684.00000002.84971.0433A000.00000004.mdmp\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00006684.00000002.84971.0433A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00006684-00000C2C-268743878\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3.bin\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006684.00000000.81129.02FA0000.00000004.mdmp, 00000000-00006684.00000001.83050.02FA0000.00000004.mdmp, 00000000-00006684.00000002.84971.02FA0000.00000004.mdmp, 00000000-00006684.00000003.90472.02FA0000.00000004.mdmp\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00006684.00000002.84971.0433A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e645744e2e46590c0e58dc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"