26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T432,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample e191f22a5072… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample e191f22a5072…. Threat score 70/100. 0/24 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e191f22a50725e5eedf8a12375a3d3171a67d9deb8ea8fa856506e9dae4ed59b","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","e191f22a50725e5eedf8a12375a3d3171a67d9deb8ea8fa856506e9dae4ed59b"],"about":{"@type":"SoftwareApplication","name":"SystemInformer.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"e191f22a50725e5eedf8a12375a3d3171a67d9deb8ea8fa856506e9dae4ed59b","additionalType":"Suspicious sample"},"threatScore":70,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":0,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T547,Found reference to API (Indicator: "NtWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtWaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegReplaceKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegRestoreKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetKeySecurity"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegFlushKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValue"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegSaveKey"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKey"; Source: "sample.bin"), Found reference to API (Indicator: "NtReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "RegLoadKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKey"; Source: "sample.bin"), Found reference to API (Indicator: "NtWaitForMultipleObjects"; Source: "sample.bin")28:Tc59,"Software\SystemInformer" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\" in Source: sample.bin, "System\CurrentControlSet\Control\ServiceGroupOrder" in Source: sample.bin, "System\CurrentControlSet\Control" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\HostComputeService\VolatileStore\ComputeSystem\" in Source: sample.bin, "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\" in Source: sample.bin, "System\CurrentControlSet\Enum\" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\KnownFunctionTableDlls" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Svchost" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\DeviceAccess\CapabilityMappings" in Source: sample.bin, "Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: sample.bin, "System\CurrentControlSet\Control\Session Manager\Environment" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" in Source: sample.bin, "Software\Microsoft\Wbem\Scripting" in Source: sample.bin, "System\CurrentControlSet\Control\NetworkProvider\Order" in Source: sample.bin, "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Ole" in Source: sample.bin, "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\DeviceAccess\" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\" in Source: sample.bin, "Software\Microsoft\Windows Kits\Installed Roots" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Lxss" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\Capabilities" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\SilentProcessExit" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Virtualization\GuestCommunicationServices\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites" in Source: sample.bin, "\Registry\Machine\Software\Classes" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\HostComputeService\VolatileStore\ComputeSystem" in Source: sample.bin, "System\CurrentControlSet\Control\SafeBoot" in Source: sample.bin, "HKCU\Software\Classes" in Source: sample.bin, "System\CurrentControlSet\Services" in Source: sample.bin, "System\CurrentControlSet\Services\Tcpip\Parameters" in Source: sample.bin, "System\CurrentControlSet\Control\Class\" in Source: sample.bin, "HKU\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin29:T4d7,Found string "\Device\HvSocketSystem\HvSocketControl" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Device\MountPointManager" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Device\HvSocketSystem" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Device\Afd" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\System32\Drivers\" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "\System32\Drivers\" (Indicator: "system32\drivers"; Source: "sample.bin"), Found string "\Driver\" (Indicator: "\driver\"; Source: "sample.bin"), Found string "\Device\" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Device\Mup\wsl.localhost\" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Device\NamedPipe\ProtectedPrefix\" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Device\Mup" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Device\NamedPipe\" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Device\HvSocket" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Driver\KSystemInformer" (Indicator: "\driver\"; Source: "sample.bin")2a:T91d,Found reference to API "ntdll.dll!NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API "ntdll.dll!NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "sample.bin"), Found reference to API "ntdll.dll!NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API "ntdll.dll!NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "sample.bin"), Found reference to API "ACPI Sleep Button" (Indicator: " Sleep "; Source: "sample.bin"), Found reference to API "NtUserMsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API "kernel32.dll!WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API "ntdll.dll!NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "sample.bin"), Found reference to API "ntdll.dll!ZwWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API "kernel32.dll!WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API "ntdll.dll!ZwWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API "win32u.dll!NtUserMsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API "win32u.dll!NtUserMsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API "win32u.dll!NtUserMsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "sample.bin"), Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API "NtUserMsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API "NtUserMsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e191f22a50725e5eedf8a12375a3d3171a67d9deb8ea8fa856506e9dae4ed59b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1792813239897,"unified_at":"2026-10-24T03:40:39.897Z","metadata":{"hashes":{"sha256":"e191f22a50725e5eedf8a12375a3d3171a67d9deb8ea8fa856506e9dae4ed59b","sha1":"aabb88fb5e27950ca370caf39a66cc8e9153ec2a","md5":"568370d70c784f93558cbd942ba96a25"},"file_info":{"file_name":"SystemInformer.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":5455872,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792813206000,"last_seen":1792813206000,"last_multi_scan":1792813206000}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":27},"sandbox_signatures":{"informative_count":34,"suspicious_count":7,"malicious_count":0,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Able to access Windows Development Kit registry key"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"suspicious","value":"References suspicious system modules"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contains ability to use Webdav for network"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping statistics\" (Indicator: \"ping \"; Source: \"sample.bin\"), Found string \"Ping the Hostname or IP Address\" (Indicator: \"ping \"; Source: \"sample.bin\"), Found string \"Ping \" (Indicator: \"ping \"; Source: \"sample.bin\"), Found string \"Ping packet length:\" (Indicator: \"ping \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"\\appxmetadata\\codeintegrity.cat\", Pattern match: \"https://systeminformer.sourceforge.io\", Pattern match: \"https://systeminformer.io/settings.schema.json\", Pattern match: \"https://github.com/winsiderss/systeminformer/commit/\", Pattern match: \"https://github.com/wj32\", Pattern match: \"https://cn.bing.com/search?q=%s\", Pattern match: \"https://github.com/gametechdev/presentmon\", Pattern match: \"https://msdl.microsoft.com/download/symbols\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://systeminformer.sourceforge.io\", Found HTTPS url \"https://systeminformer.io\", Found HTTPS url \"https://github.com\", Found HTTPS url \"https://cn.bing.com\", Found HTTPS url \"https://msdl.microsoft.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to use Webdav for network","description":"Found string \"WebDAV \" (Indicator: \"webdav\"; Source: \"sample.bin\"), Found string \"FILE_CHARACTERISTIC_WEBDAV_DEVICE\" (Indicator: \"webdav\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-476","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.1.1.1\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping statistics\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Ping the Hostname or IP Address\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"Ping the Hostname or IP Address\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Ping \" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Ping packet length:\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValue\" in \"sample.bin\", Found registry query API: \"RegEnumValue\" in \"sample.bin\", Found registry query API: \"RegOpenKey\" in \"sample.bin\", Found registry query API: \"RegSaveKey\" in \"sample.bin\", Found registry query API: \"RegEnumKey\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1558","id":"string-868","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"ntdll.dll!NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$28","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"ntdll.dll!NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"sample.bin\"), Found reference to API \"ntdll.dll!NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\"), Found reference to API \"ntdll.dll!ZwDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\"), Found reference to API \"ntdll.dll!NtFsControlFile\" (Indicator: \"FsControlFile\"; Source: \"sample.bin\"), Found reference to API \"ntdll.dll!ZwFsControlFile\" (Indicator: \"FsControlFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteRetrieveIdentityFromCurrentProcess\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"EnableShellExecuteSkipIfeoDebugger\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileAccess\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"LaunchCreateProcessExtensions\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"BypassCreateProcessAppxExtension\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\" (Antimalware)\" (Indicator: \"antimalware\") in Source: sample.bin, \"Antimalware\" (Indicator: \"antimalware\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey\" in \"sample.bin\", Found registry modification API: \"RegLoadKey\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"*.exe;*.dll;*.com;*.ocx;*.sys;*.scr;*.cpl;*.ax;*.acm;*.lib;*.winmd;*.mui;*.mun;*.efi;*.pdb\", \" (*.exe;*.dll;*.com;*.ocx;*.sys;*.scr;*.cpl;*.ax;*.acm;*.lib;*.winmd;*.mui;*.mun;*.efi;*.pdb)\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to access Windows Development Kit registry key","description":"Found string \"Software\\Microsoft\\Windows Kits\\Installed Roots\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1068","id":"string-976","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\" (wj32 - Wen Jia Liu\n dmex - Steven G\n jxy-s - Johnny Shaw\n ionescu007 - Alex Ionescu\n yardenshafir - Yarden Shafir\n \" (Indicator: \"github.com\"), \"\n PresentMon - Intel Corporation\n Mini-XML - Michael Sweet\n PCRE2 - Philip Hazel\n json-c - Michael Clark\n MD5 \" (Indicator: \"github.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"ProviderOperation_AccessCheck\" (Indicator: \"AccessCheck\"; Source: \"sample.bin\"), Found reference to API \"FileLinkInformationBypassAccessCheck\" (Indicator: \"AccessCheck\"; Source: \"sample.bin\"), Found reference to API \"FileRenameInformationExBypassAccessCheck\" (Indicator: \"AccessCheck\"; Source: \"sample.bin\"), Found reference to API \"FileLinkInformationExBypassAccessCheck\" (Indicator: \"AccessCheck\"; Source: \"sample.bin\"), Found reference to API \"FileRenameInformationBypassAccessCheck\" (Indicator: \"AccessCheck\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$29","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValue\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKey\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"sample.bin\"), Found reference to \"SHA512-256\" (Indicator: \"SHA512\"; Source: \"sample.bin\"), Found reference to \"SHA512-224\" (Indicator: \"SHA512\"; Source: \"sample.bin\"), Found reference to \"SHA512/224\" (Indicator: \"SHA512\"; Source: \"sample.bin\"), Found reference to \"SHA512/256\" (Indicator: \"SHA512\"; Source: \"sample.bin\"), Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegReplaceKey\" (Indicator: \"RegReplaceKey\"; Source: \"sample.bin\"), Found reference to API \"RegRestoreKey\" (Indicator: \"RegRestoreKey\"; Source: \"sample.bin\"), Found reference to API \"RegSetKeySecurity\" (Indicator: \"RegSetKeySecurity\"; Source: \"sample.bin\"), Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"sample.bin\"), Found reference to API \"RegSetValue\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\"), Found reference to API \"RegRenameKey\" (Indicator: \"RegRenameKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"%SystemRoot%\\explorer.exe /select,\"%s\"\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\"), Found string \"\\explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\"), Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"Found string \"ntoskrnl.exe\" (Indicator: \"ntoskrnl\"; Source: \"sample.bin\"), Found string \"\\csrss.exe\" (Indicator: \"csrss\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547.006","id":"string-24","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"\\rdpinit.exe\" (Indicator: \"rdpinit.exe\"), \"\\taskhostex.exe\" (Indicator: \"taskhostex.exe\")","origin":"sample.bin","id":"string-65","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,winlogon.exe,lsm.exe,rundll32.exe,csrss.exe\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-455","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"\\regedit.exe\" (Indicator: \"regedit.exe\"; Source: \"sample.bin\"), Found string \"windbg.exe\" (Indicator: \"windbg.exe\"; Source: \"sample.bin\"), Found string \"TASKMGR.EXE\" (Indicator: \"taskmgr.exe\"; Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\taskmgr.exe\" (Indicator: \"taskmgr.exe\"; Source: \"sample.bin\"), Found string \"\\taskmgr.exe\" (Indicator: \"taskmgr.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-45","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\wbem\\WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"sample.bin\"), Found string \"root\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1574.007","id":"string-530","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\taskmgr.exe\" (Indicator: \"software\\microsoft\\windows nt\\currentversion\\image file execution options\"; in Source: \"sample.bin\"), Found string \"System\\CurrentControlSet\\Control\\NetworkProvider\\Order\" (Indicator: \"system\\currentcontrolset\\control\\networkprovider\\order\"; in Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1055.011","id":"string-4","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \" (