26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample e3fb74c64c50… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e3fb74c64c50…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 3/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253"],"about":{"@type":"SoftwareApplication","name":"Product List1.exe","applicationCategory":["peexe","executable"],"identifier":"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6e3,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "czkuw.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RU") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "RU") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RO-RO") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "RO-RO") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RO") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "RO") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RM-CH") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "RM-CH") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RM") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "RM") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PT-BR") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PT-BR") "czkuw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PT")28:T76d,".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CZKUW.EXE" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WINMM.DLL" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ODBC32.DLL" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\PDH.DLL" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RTUTILS.DLL" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MSI.DLL" "czkuw.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "czkuw.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "czkuw.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" "czkuw.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" "czkuw.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\NTDLL.DLL" "czkuw.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\WINHTTP.DLL" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CREDSSP.DLL" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IPHLPAPI.DLL" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WINNSI.DLL" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DHCPCSVC6.DLL" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DHCPCSVC.DLL" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MSCOREE.DLL"29:T401,".exe" trying to access non-existent file "C:\E3FB74C64C50D0F15D69BEE2936DC896C554D63000A14A8947785FE82B02F253.EXE.LOCAL" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WYQUXUQEEY.T" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\LLHREAYR.QD" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CZKUW.EXE.LOCAL" "czkuw.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "czkuw.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CZKUW.EXE.CONFIG" "czkuw.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "czkuw.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "czkuw.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\SYSTEM.WEB.EXTENSIONS.INI"2a:T46f,"czkuw.exe" opened file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\YA LOGIN DATA" "czkuw.exe" opened file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" opened file "C:\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" opened file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" opened file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\FILEZILLA\RECENTSERVERS.XML" "czkuw.exe" opened file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\COMODO\ICEDRAGON\PROFILES" "czkuw.exe" opened file "%LOCALAPPDATA%\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\YA LOGIN DATA" "czkuw.exe" opened file "%LOCALAPPDATA%\NICHROME\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" opened file "%LOCALAPPDATA%\GOOGLE\CHROME\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" opened file "%LOCALAPPDATA%\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA"2b:Te66,"czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "IMAP PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "HTTP PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "SMTP PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "HTTP PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "POP3 PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "IMAP PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "SMTP PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "HTTP PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "POP3 PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "IMAP PASSWORD") "czkuw.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676")2c:Ta52,"czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\YA LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XPOM\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SLIMJET\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GHOSTBROWSER\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XVAST\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\LOGIN DATA" "czkuw.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER\USER DATA_I18N\DEFAULT\UC LOGIN DATA.18"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791549158993,"unified_at":"2026-10-09T12:32:38.993Z","metadata":{"hashes":{"sha256":"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253","sha1":"528a66178c37790d09835d126504391a9b31baff","md5":"ea1d2ce5aa650d5c46f759c11065fa1c","sha512":"f463a13a5c015579c40d62ce16e5d96263e925d1f970d91810fe8d5b37ce7e3b36ab02782cf86dcd3ed3a807394f214435a69e74682a09d09f8dd6f08b5b9ca7","ssdeep":"3072:/fY/TU9fE9PEtuZXbsMfv6jI7BKlBYTNbtihGqScvkYa3E0KiBY15ltKrQpwJs4B:XYa6HLsiKlIRihG4v9a3E0K6QpL7Y","ssdeep_chunks":["3072:/fY/TU9","3072:fY/TU9f","3072:Y/TU9fE","3072:/TU9fE9","3072:TU9fE9P","3072:U9fE9PE","3072:9fE9PEt","3072:fE9PEtu","3072:E9PEtuZ","3072:9PEtuZX","3072:PEtuZXb","3072:EtuZXbs","3072:tuZXbsM","3072:uZXbsMf","3072:ZXbsMfv","3072:XbsMfv6","3072:bsMfv6j","3072:sMfv6jI","3072:Mfv6jI7","3072:fv6jI7B","3072:v6jI7BK","3072:6jI7BKl","3072:jI7BKlB","3072:I7BKlBY","3072:7BKlBYT","3072:BKlBYTN","3072:KlBYTNb","3072:lBYTNbt","3072:BYTNbti","3072:YTNbtih","3072:TNbtihG","3072:NbtihGq","3072:btihGqS","3072:tihGqSc","3072:ihGqScv","3072:hGqScvk","3072:GqScvkY","3072:qScvkYa","3072:ScvkYa3","3072:cvkYa3E","3072:vkYa3E0","3072:kYa3E0K","3072:Ya3E0Ki","3072:a3E0KiB","3072:3E0KiBY","3072:E0KiBY1","3072:0KiBY15","3072:KiBY15l","3072:iBY15lt","3072:BY15ltK","3072:Y15ltKr","3072:15ltKrQ","3072:5ltKrQp","3072:ltKrQpw","3072:tKrQpwJ","3072:KrQpwJs","3072:rQpwJs4","3072:QpwJs4B","6144:/fY/TU9","6144:fY/TU9f","6144:Y/TU9fE","6144:/TU9fE9","6144:TU9fE9P","6144:U9fE9PE","6144:9fE9PEt","6144:fE9PEtu","6144:E9PEtuZ","6144:9PEtuZX","6144:PEtuZXb","6144:EtuZXbs","6144:tuZXbsM","6144:uZXbsMf","6144:ZXbsMfv","6144:XbsMfv6","6144:bsMfv6j","6144:sMfv6jI","6144:Mfv6jI7","6144:fv6jI7B","6144:v6jI7BK","6144:6jI7BKl","6144:jI7BKlB","6144:I7BKlBY","6144:7BKlBYT","6144:BKlBYTN","6144:KlBYTNb","6144:lBYTNbt","6144:BYTNbti","6144:YTNbtih","6144:TNbtihG","6144:NbtihGq","6144:btihGqS","6144:tihGqSc","6144:ihGqScv","6144:hGqScvk","6144:GqScvkY","6144:qScvkYa","6144:ScvkYa3","6144:cvkYa3E","6144:vkYa3E0","6144:kYa3E0K","6144:Ya3E0Ki","6144:a3E0KiB","6144:3E0KiBY","6144:E0KiBY1","6144:0KiBY15","6144:KiBY15l","6144:iBY15lt","6144:BY15ltK","6144:Y15ltKr","6144:15ltKrQ","6144:5ltKrQp","6144:ltKrQpw","6144:tKrQpwJ","6144:KrQpwJs","6144:rQpwJs4","6144:QpwJs4B","3072:XYa6HLs","3072:Ya6HLsi","3072:a6HLsiK","3072:6HLsiKl","3072:HLsiKlI","3072:LsiKlIR","3072:siKlIRi","3072:iKlIRih","3072:KlIRihG","3072:lIRihG4","3072:IRihG4v","3072:RihG4v9","3072:ihG4v9a","3072:hG4v9a3","3072:G4v9a3E","3072:4v9a3E0","3072:v9a3E0K","3072:9a3E0K6","3072:a3E0K6Q","3072:3E0K6Qp","3072:E0K6QpL","3072:0K6QpL7","3072:K6QpL7Y"],"imphash":"61259b55b8912888e90f516ca08dc514"},"file_info":{"file_name":"Product List1.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":186255,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1677058808000,"last_seen":1677058808000,"last_multi_scan":1677058808000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":26},"sandbox_signatures":{"informative_count":37,"suspicious_count":17,"malicious_count":8,"total":62},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.bf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"PE file contains zero-size sections"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Defense Evasion","technique":"Binary Padding","attack_id":"T1027.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/001","identifiers":[{"type":"informative","value":"PE file contains data exceeding the last FAT sector (overlay)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retreive system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal desktop applications information (file access)"},{"type":"suspicious","value":"Checks on FTP client related files"},{"type":"suspicious","value":"Tries to steal Pidgin account information (file access)"},{"type":"suspicious","value":"Tries to access browsers sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"suspicious","value":"Tries to access mail clients information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size (API string)","description":"Observed string:\"GetDiskFreeSpaceW\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]\n Observed string:\"GetDiskFreeSpaceExW\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"czkuw.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"czkuw.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retreive system language (API string)","description":"Observed api:\"GetUserDefaultUILanguage\"[Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed string:\"GetVersionExW \" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"czkuw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"czkuw.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"193.122.130.0:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"CreateThread\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\PROGID\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"PE file contains data exceeding the last FAT sector (overlay)","description":"Pe file has overlay in e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin","origin":"Static Parser","mitre_attack_id":"T1027.001","relevance":1,"id":"static-131","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin\" has an writable section named \".data\"\n \"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin\" has an writable section named \".ndata\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin\" file has an entrypoint instructions - \"pushebp,movebp, esp,subesp, 0x3f4,pushebx,pushesi,pushedi,push0x20,popedi,xorebx, ebx,push0x8001,movdword ptr [ebp - 0x14], ebx,movdword ptr [ebp - 4], 0x40a230,movdword ptr [ebp - 0x10], ebx,calldword ptr [0x4080c8],movesi, dword ptr [0x4080cc],leaeax, [ebp - 0x140],pusheax,movdword ptr [ebp - 0x12c], ebx,movdword ptr [ebp - 0x2c], ebx,movdword ptr [ebp - 0x28], ebx,movdword ptr [ebp - 0x140], 0x11c,callesi,testeax, eax,jne0x4036ca,leaeax, [ebp - 0x140],movdword ptr [ebp - 0x140], 0x114,pusheax,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"czkuw.exe\" with commandline \"%TEMP%\\llhreayr.qd\" (UID: 00000000-00004052)\n Spawned process \"czkuw.exe\" (UID: 00000000-00003196)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"czkuw.exe\" with commandline \"%TEMP%\\llhreayr.qd\" (UID: 00000000-00004052)\n Spawned process \"czkuw.exe\" (UID: 00000000-00003196)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$28","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$29","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Heuristic match: \"checkip.dyndns.org\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed api string:\"SystemParametersInfoW\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Observed string:\"OpenClipboard\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindFirstFileW\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]\n Observed api string:\"FindNextFileW\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed api string:\"GetSystemMetrics\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"System Security","name":"Contains ability to enable or disable privileges in the specified access token (API string)","description":"Observed api string:\"AdjustTokenPrivileges\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed api string:\"SetFileSecurityW which can Sets the security of a file or directory object\"[Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed api string:\"SeShutdownPrivilege which can Shut down the system\"[Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"czkuw.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"SetFileSecurityW\" which can \"Sets the security of a file or directory object\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Observed string:\"ExitWindowsEx\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]\n Observed string:\"InitiateShutdownW\" [Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin]","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found - (Indicator: \"des\") in Source: e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin\n Found - (Indicator: \"des\") in Source: 00000000-00003164-00000BC0-17078762\n Found - (Indicator: \"rsa\") in Source: 00000000-00003164-00000BC0-17080643\n Found - (Indicator: \"des\") in Source: 00000000-00003164-00000BC0-17088603\n Found - (Indicator: \"des\") in Source: 00000000-00003164-00000BC0-17094085","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to steal Pidgin account information (file access)","description":"\"czkuw.exe\" trying to open a file \"%APPDATA%\\.PURPLE\\ACCOUNTS.XML\"\n \"czkuw.exe\" trying to open a file \"%APPDATA%\\.PURPLE\\ACCOUNTS.XML\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-116","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"41/69 Antivirus vendors marked sample as malicious (59% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin\" has resource with unusual entropy \"RT_ICON:7.74002674717\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" reads file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\".exe\" wrote 16384 bytes starting with PE header signature to file \"%TEMP%\\czkuw.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"58.16.99.30\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 193.122.130.0 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"$2a","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access browsers sensitive information (file access)","description":"\"czkuw.exe\" trying to open a file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"czkuw.exe\" trying to open a file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-132","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"\"czkuw.exe\" trying to open a file \"%APPDATA%\\THUNDERBIRD\\PROFILES\"\n \"czkuw.exe\" trying to open a file \"%APPDATA%\\POSTBOXAPP\\PROFILES\"\n \"czkuw.exe\" trying to open a file \"%APPDATA%\\THUNDERBIRD\\PROFILES\"\n \"czkuw.exe\" trying to open a file \"%APPDATA%\\POSTBOXAPP\\PROFILES\"","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"%TEMP%\\nswCA2C.tmp\" for deletion\n \".exe\" marked \"%TEMP%\\nscCA4E.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%TEMP%\\nswCA2C.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\nscCA4E.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegEnumKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n CopyFileW\n GetModuleFileNameW\n GetVersionExW\n GetFileAttributesW\n GetFileSize\n GetCommandLineW\n LoadLibraryExW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n GetModuleHandleA\n CreateThread\n GetSystemDirectoryW\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n GetModuleHandleW\n WriteFile\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n ShellExecuteExW\n FindWindowExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.bin\" has a section named \".ndata\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"czkuw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"41/69 Antivirus vendors marked sample as malicious (59% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"17/70 Antivirus vendors marked spawned process \"czkuw.exe\" (PID: 4052) as malicious (classified as \"Gen:Variant.Babar\" with 24% detection rate)\n 17/70 Antivirus vendors marked spawned process \"czkuw.exe\" (PID: 3196) as malicious (classified as \"Gen:Variant.Babar\" with 24% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$2c","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\"czkuw.exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"czkuw.exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Tries to steal desktop applications information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the windows installation language"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"63f7cee1b66deed593095b73","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253","analysis_start_time":"2023-02-23T20:38:57+00:00","indicators_count":{"informative":37,"suspicious":18,"malicious":8},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"193.122.130.0","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]}],"dns_resolutions":[{"domain":"checkip.dyndns.org","address":"193.122.130.0","ttl":353,"country":"United States","registrar_name":"Tucows Inc.","registrar_organization":"Dynamic Network Services, Inc.","registrar_name_servers":"NS2.DYNDNS.ORG","registrar_creation_date":"1998-11-22T05:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]}],"http_requests":[{"host":"checkip.dyndns.org","host_ip":"193.122.130.0:80","url":"/","method":"GET","header":"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}],"processes":[{"pid":3164,"ppid":0,"name":"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.exe","command_line":"","sha256":"e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253","normalized_path":"C:\\e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253.exe","uid":"00000000-00003164","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAArklEQVR42u2VWw5AMBBFbUg0SkKw/334Ix5LKPXKZNAg6YzQGxPx457Oq57n9FV1Raz+C9DkUkEA/d2n8jmQCCN1Jc5OT5INE4SaHiJhCJ1+a2Y1qvURBFu3k0BocwhgakyWWScB4F042XxCFohpxJYM4KAxR/NdJcFmbhWiBEamslhRO/6ctenY7/hXaF0ucNPhN8m1Gwi5W7Uk6xcaHAG4HrFa97vhC+FK4vR+DR4trS7GlLUVAAAAAElFTkSuQmCC"},{"pid":4052,"ppid":3164,"name":"czkuw.exe","command_line":"%TEMP%\\llhreayr.qd","sha256":"85d288b91abf1203fe4c8aa8f0fa60eaa023575eb269a078e0c6282dcae7913d","normalized_path":"%TEMP%\\czkuw.exe","parent_uid":"00000000-00003164","uid":"00000000-00004052"},{"pid":3196,"ppid":4052,"name":"czkuw.exe","command_line":"","sha256":"85d288b91abf1203fe4c8aa8f0fa60eaa023575eb269a078e0c6282dcae7913d","normalized_path":"%TEMP%\\czkuw.exe","parent_uid":"00000000-00004052","uid":"00000000-00003196"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"path":"%TEMP%\\nsmCA3D.tmp","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63f7cee1b66deed593095b73"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["63f7cee1b66deed593095b73"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample e3fb74c64c50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e3fb74c64c50…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 3/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample e3fb74c64c50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e3fb74c64c50…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 3/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e3fb74c64c50d0f15d69bee2936dc896c554d63000a14a8947785fe82b02f253"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample e3fb74c64c50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e3fb74c64c50…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 3/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]