26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 54:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mikey.Generic Sample e1f10695ba1b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e1f10695ba1b…. Malware family: Mikey.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c","keywords":["Malicious","Mikey.Generic","malware analysis","sandbox report","threat intelligence","e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mikey.Generic","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T711,Found string "bad decompression" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "compression disabled" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "compression failure" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "compression id not within private range" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "compression library error" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "duplicate compression id" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "illegal point compression" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "inconsistent compression" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "invalid compression algorithm" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "no compression specified" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "old session compression algorithm not returned" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "required compression algorithm missing" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "sslv3 alert decompression failure" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "unsupported compression algorithm" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "zlib compression" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "invalid compression bit" (Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp")28:T910,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004592.00000001.129652.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00FA3000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004592.00000001.129652.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00FA3000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006632.00000000.129955.013D3000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006632.00000000.129955.013D3000.00000002.mdmp")29:Te11,Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "ECDHE-ECDSA-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "DHE-RSA-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "DHE-DSS-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "ADH-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_DH_anon_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "ECDHE-ECDSA-AES256-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "ECDHE-RSA-AES256-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "ECDHE-RSA-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "PSK-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_PSK_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "DHE-PSK-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to "RSA-PSK-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp")2a:T678,"sysfrodolv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC") "sysfrodolv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC") "sysfrodolv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC") "sysfrodolv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX") "sysfrodolv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX") "sysfrodolv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK") "sysfrodolv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK") "sysfrodolv.exe" (Access type: "OPEN"; Path: "HKCU\APPID\SYSFRODOLV.EXE") "sysfrodolv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\APPID\SYSFRODOLV.EXE") "sysfrodolv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT") "sysfrodolv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT") "sysfrodolv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "sysfrodolv.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA") "sysfrodolv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA") "sysfrodolv.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{00000134-0000-0000-C000-000000000046}") "sysfrodolv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00000134-0000-0000-C000-000000000046}") "sysfrodolv.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{00000134-0000-0000-C000-000000000046}\PROXYSTUBCLSID32")2b:T65a,"" (Indicator: "GetDC"; Source: "00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006632.00000000.129955.00C70000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006632.00000000.129955.00C70000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006632.00000000.129955.00C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006632.00000000.129955.00C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006632.00000000.129955.00C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006632.00000000.129955.00C70000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006632.00000000.129955.00C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006632.00000000.129955.00C70000.00000004.mdmp")49:T1370,Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "aECDSA" (Indicator: "ecdsa"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "3DES" (Indicator: "3des"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "AES128" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "AES128" (Indicator: "aes128"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "AES256" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "AES256" (Indicator: "aes256"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "AESGCM" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "AESCCM" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "AESCCM8" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "CHACHA20" (Indicator: "chacha"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ECDHE-ECDSA-AES256-GCM-SHA384" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ECDHE-ECDSA-AES256-GCM-SHA384" (Indicator: "aes256"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ECDHE-ECDSA-AES256-GCM-SHA384" (Indicator: "ecdsa"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384" (Indicator: "aes128"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384" (Indicator: "aes256"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384" (Indicator: "ecdsa"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ECDHE-ECDSA-AES128-GCM-SHA256" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ECDHE-ECDSA-AES128-GCM-SHA256" (Indicator: "aes128"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ECDHE-ECDSA-AES128-GCM-SHA256" (Indicator: "ecdsa"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" (Indicator: "chacha"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "TLS_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "TLS_AES_256_GCM_SHA384" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "TLS_CHACHA20_POLY1305_SHA256" (Indicator: "chacha"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "TLS_AES_128_CCM_SHA256" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "TLS_AES_128_CCM_8_SHA256" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "AES128-SHA" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "AES128-SHA" (Indicator: "aes128"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "TLS_RSA_WITH_AES_128_CBC_SHA" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "DHE-DSS-AES128-SHA" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "DHE-DSS-AES128-SHA" (Indicator: "aes128"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "DHE-RSA-AES128-SHA" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "DHE-RSA-AES128-SHA" (Indicator: "aes128"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" (Indicator: "aes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp")4a:Tade,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004592.00000001.129652.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00FA3000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004592.00000001.129652.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00FA3000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006632.00000000.129955.013D3000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006632.00000000.129955.013D3000.00000002.mdmp")4b:T84e,Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "ReadDirectoryChangesW" (Indicator: "ReadDirectoryChange"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00004592.00000001.129652.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00FA3000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00006632.00000000.129955.013D3000.00000002.mdmp")4c:T425,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp")4d:Tc61,Found string "tls13_generate_secret" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "derive_secret_key_and_iv" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "srp_generate_server_master_secret" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "srp_generate_client_master_secret" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ssl3_generate_master_secret" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "secret" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "extended master secret" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "master secret" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "secretBag" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "secretary" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "password based MAC" (Indicator: "password"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ossl_pw_set_pem_password_cb" (Indicator: "password"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "No password method specified" (Indicator: "password"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "hexsecret" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "empty password" (Indicator: "password"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "maybe wrong password" (Indicator: "password"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "invalid secret" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "invalid secret length" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "bad password read" (Indicator: "password"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "problems getting password" (Indicator: "password"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "no password" (Indicator: "password"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "missing pbm secret" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "missing secret" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "PEM password callback wrapper" (Indicator: "password"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "spend-secret-key" (Indicator: "secret"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp")4e:T4aa,Found string "hostname mismatch" (Indicator: "hostname"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "no hostname or service specified" (Indicator: "hostname"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "Hostname" (Indicator: "hostname"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp, 00000000-00003964.00000000.129873.BA1F0000.00000004.mdmp") Found string "HOSTNAME" (Indicator: "hostname"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "--tls-gen=HOSTNAME generate TLS certificate for specific hostname" (Indicator: "hostname"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ping time" (Indicator: "ping"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "ping" (Indicator: "ping"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found string "Hostname" (Indicator: "hostname"; Source: "00000000-00005732.00000000.130154.B6F70000.00000004.mdmp, 00000000-00005732.00000001.132073.B6F70000.00000004.mdmp, 00000000-00005732.00000002.133994.B6F70000.00000004.mdmp")4f:T644,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003964.00000000.129873.BA1F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\sysmgnrsv.exe" (Indicator: "\Device\"; Source: "00000000-00003964.00000000.129873.BA1F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin.exe" (Indicator: "\Device\"; Source: "00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005732.00000000.130154.B6F70000.00000004.mdmp, 00000000-00005732.00000001.132073.B6F70000.00000004.mdmp, 00000000-00005732.00000002.133994.B6F70000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\sysmgnrsv.exe" (Indicator: "\Device\"; Source: "00000000-00005732.00000000.130154.B6F70000.00000004.mdmp, 00000000-00005732.00000001.132073.B6F70000.00000004.mdmp, 00000000-00005732.00000002.133994.B6F70000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006632.00000000.129955.00C70000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\sysfrodolv.exe" (Indicator: "\Device\"; Source: "00000000-00006632.00000000.129955.00C70000.00000004.mdmp")50:T55e,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003964.00000000.129873.2F81F000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004592.00000001.129652.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00FA3000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004592.00000001.129652.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00FA3000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006632.00000000.129955.013D3000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006632.00000000.129955.013D3000.00000002.mdmp")51:T9e1,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006632.00000000.129955.00C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\WinRing0_1_2_0; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"like\" in header \"GET /xmrig.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 178.16.54.109\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match – cryptographic algorithms\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005732-00000C2C-994571765\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system firmware table (API string)","description":"file/memory contains long string(Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1592.003","relevance":1,"id":"string-902","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005732-00000C2C-994571765\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfigA\" (Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003964.00000000.129873.2F81F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004592.00000000.128940.00C60000.00000004.mdmp, 00000000-00004592.00000001.129652.00C60000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006632.00000000.129955.00C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" HTTP/1.1 200 OK\nServer: nginx/1.18.0 (Ubuntu)\nDate: Mon\n 09 Mar 2026 19:52:17 GMT\nContent-Type: application/octet-stream\nContent-Length: 6455808\nLast-Modified: Sun\n 08 Mar 2026 16:37:46 GMT\nConnection: keep-alive\nETag: \"69ada5da-628200\"\nAccept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\" Microsoft\"\n \"sysfrodolv.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69af24c615973751a4048fb7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"