24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample e64b4314bf8f… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample e64b4314bf8f…. Malware family: Win/malicious_confidence_100%. Threat score 85/100. 7/27 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e64b4314bf8f0471aa3d2db91ad949b3e88e39080524ed613f5a0e1fd29e187b","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","e64b4314bf8f0471aa3d2db91ad949b3e88e39080524ed613f5a0e1fd29e187b"],"about":{"@type":"SoftwareApplication","name":"PO 18-7 309.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"e64b4314bf8f0471aa3d2db91ad949b3e88e39080524ed613f5a0e1fd29e187b","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T40a,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006704.00000000.152016.6F5A1000.00000020.mdmp, 00000000-00006704.00000000.152016.6F681000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp")26:T66e,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp, 00000000-00006704.00000000.152016.6F695000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp, 00000000-00006704.00000000.152016.6F695000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp")27:T1a74,Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "AMSI") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "AMSI") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00006704.00000000.152016.055C0000.00000004.mdmp")28:T502,"" - Source: "00000000-00006704.00000000.152016.6F681000.00000020.mdmp")3d:T9e4,"" (Indicator: "GetDC"; Source: "00000000-00006704.00000000.152016.03280000.00000004.mdmp, 00000000-00006704.00000001.153482.03280000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006704.00000000.152016.03280000.00000004.mdmp, 00000000-00006704.00000001.153482.03280000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006704.00000000.152016.03280000.00000004.mdmp, 00000000-00006704.00000001.153482.03280000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006704.00000000.152016.03280000.00000004.mdmp, 00000000-00006704.00000001.153482.03280000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006704.00000000.152016.03280000.00000004.mdmp, 00000000-00006704.00000001.153482.03280000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006704.00000000.152016.03280000.00000004.mdmp, 00000000-00006704.00000001.153482.03280000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006704.00000000.152016.03280000.00000004.mdmp, 00000000-00006704.00000001.153482.03280000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006704.00000000.152016.03280000.00000004.mdmp, 00000000-00006704.00000001.153482.03280000.00000004.mdmp")40:T92b,Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006704.00000000.152016.6F5A1000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006704.00000000.152016.6F5A1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006704.00000000.152016.6F5A1000.00000020.mdmp, 00000000-00006704.00000000.152016.6F681000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006704.00000000.152016.6F5A1000.00000020.mdmp, 00000000-00006704.00000000.152016.6F681000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006704.00000000.152016.6F5A1000.00000020.mdmp, 00000000-00006704.00000000.152016.6F681000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006704.00000000.152016.6F5A1000.00000020.mdmp, 00000000-00006704.00000000.152016.6F681000.00000020.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp, 00000000-00006704.00000000.152016.6F695000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp, 00000000-00006704.00000000.152016.6F695000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp, 00000000-00006704.00000000.152016.6F695000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006704.00000000.152016.6F681000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006704.00000000.152016.6F681000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006704.00000000.152016.6F695000.00000002.mdmp")41:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00006704.00000000.152016.6F631000.00000002.mdmp")42:T87e,System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-600000c-frmArvore~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-6000010-frmCambioCheckBox~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-6000014-frmCambioDropDown~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-6000018-frmCambioRadioButton~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-600001d-frmCumprimentos~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-6000021-frmEx10~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-6000026-frmFahrenheit~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-600002b-frmHobbies~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-600002e-frmMeusHobbies~btnOk_Click System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-6000032-frmMeusHobbies~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-6000038-frmNomeEmail~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-600003f-frmNotaFinal~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-6000055-frmPrincipal~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-600005b-frmQuantoTempoPassou~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-6000063-frmQueHorasSao~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at abcf66db239936aaf9752c856a0fbe4d-6000069-frmTabuada~InitializeComponent1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e64b4314bf8f0471aa3d2db91ad949b3e88e39080524ed613f5a0e1fd29e187b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1791430013525,"unified_at":"2026-10-08T03:26:53.525Z","metadata":{"hashes":{"sha256":"e64b4314bf8f0471aa3d2db91ad949b3e88e39080524ed613f5a0e1fd29e187b","sha1":"83a1eccb0e2ca25727eb0205e19572faba2b80ba","md5":"abcf66db239936aaf9752c856a0fbe4d","sha512":"70d319061a4bafe8f799e3f9e6dc74f5403c3e7fd4bb65e4f5040d4a4c291efbb45f5324afd18af621204ea1d08c1e715040449716e5bf0a2bcd413d8c1542d6","ssdeep":"24576:W8f0ZLGpmtqHMb6SQ4145kk1l43lPuJL4E/Yy0:RMqpA6NAigGL4mP0","ssdeep_chunks":["24576:W8f0ZLG","24576:8f0ZLGp","24576:f0ZLGpm","24576:0ZLGpmt","24576:ZLGpmtq","24576:LGpmtqH","24576:GpmtqHM","24576:pmtqHMb","24576:mtqHMb6","24576:tqHMb6S","24576:qHMb6SQ","24576:HMb6SQ4","24576:Mb6SQ41","24576:b6SQ414","24576:6SQ4145","24576:SQ4145k","24576:Q4145kk","24576:4145kk1","24576:145kk1l","24576:45kk1l4","24576:5kk1l43","24576:kk1l43l","24576:k1l43lP","24576:1l43lPu","24576:l43lPuJ","24576:43lPuJL","24576:3lPuJL4","24576:lPuJL4E","24576:PuJL4E/","24576:uJL4E/Y","24576:JL4E/Yy","24576:L4E/Yy0","49152:W8f0ZLG","49152:8f0ZLGp","49152:f0ZLGpm","49152:0ZLGpmt","49152:ZLGpmtq","49152:LGpmtqH","49152:GpmtqHM","49152:pmtqHMb","49152:mtqHMb6","49152:tqHMb6S","49152:qHMb6SQ","49152:HMb6SQ4","49152:Mb6SQ41","49152:b6SQ414","49152:6SQ4145","49152:SQ4145k","49152:Q4145kk","49152:4145kk1","49152:145kk1l","49152:45kk1l4","49152:5kk1l43","49152:kk1l43l","49152:k1l43lP","49152:1l43lPu","49152:l43lPuJ","49152:43lPuJL","49152:3lPuJL4","49152:lPuJL4E","49152:PuJL4E/","49152:uJL4E/Y","49152:JL4E/Yy","49152:L4E/Yy0","24576:RMqpA6N","24576:MqpA6NA","24576:qpA6NAi","24576:pA6NAig","24576:A6NAigG","24576:6NAigGL","24576:NAigGL4","24576:AigGL4m","24576:igGL4mP","24576:gGL4mP0"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"PO 18-7 309.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1010688,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1768806330000,"last_seen":1768806374000,"last_multi_scan":1768806374000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":61},"sandbox_signatures":{"informative_count":186,"suspicious_count":11,"malicious_count":2,"total":199},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/GenKryptik.FQPC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005d5f371 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-AQM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.EUS.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_51.6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"suspicious","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Able to perform reflective code loading"},{"type":"informative","value":"Contains ability to load module (Dotnet string)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"e64b4314bf8f0471aa3d2db91ad949b3e88e39080524ed613f5a0e1fd29e187b.bin\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"PWB.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetDelegateForFunctionPointer\" in \"PWB.dll\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"PWB.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"ReleaseComObject\" in \"PWB.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"PWB.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to perform reflective code loading","description":"Found string \"at System.Reflection.Assembly.Load(Byte[])\" (Indicator: \"assembly.load\"; Source: \"00000000-00006704.00000001.153482.03280000.00000004.mdmp\")\n Found string \"at System.Reflection.Assembly.Load(Byte[] rawAssembly)\" (Indicator: \"assembly.load\"; Source: \"00000000-00006704.00000001.153482.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":3,"id":"string-678","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006704.00000000.152016.03280000.00000004.mdmp, 00000000-00006704.00000001.153482.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006704.00000000.152016.03280000.00000004.mdmp\n 00000000-00006704.00000001.153482.03280000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"PWB.dll\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"PWB.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System.Diagnostics\" and MemberReference \"GetMethod\" in \"PWB.dll\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"PWB.dll\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"PWB.dll has big resource with name: \"BxSgC53\" size: \"285185\" and abnormal entropy:\"7.997439600867758\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006704.00000000.152016.065C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006704.00000001.153482.096D0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00004848]\n Process \"WerFault.exe\" [UID: 00000000-00002784]\n Process \"WerFault.exe\" [UID: 00000000-00003492]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"PWB.dll\"\n Observed function \"ToBase64String\" in \"PWB.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00006704.00000000.152016.6F5A1000.00000020.mdmp, 00000000-00006704.00000000.152016.6F631000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00006704.00000000.152016.6F5A1000.00000020.mdmp, 00000000-00006704.00000000.152016.6F631000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp, 00000000-00006704.00000000.152016.065C0000.00000004.mdmp, 00000000-00006704.00000001.153482.096D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"PWB.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"PWB.dll\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"PWB.dll\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"PWB.dll\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"PWB.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"PWB.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.81961","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2a","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006704-00000C2C-1346979225\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006704-00000C2C-1346979225\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00006704-00000C2C-1347321079\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006704-00000C2C-1346161530\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006704-00000C2C-1346162039\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp, 00000000-00006704.00000000.152016.6F695000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006704.00000000.152016.03280000.00000004.mdmp, 00000000-00006704.00000001.153482.03280000.00000004.mdmp\")\n Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\"\n Found registry query API: \"RegNotifyChangeKeyValue\" in \"00000000-00006704.00000000.152016.6F631000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"\" (Indicator: \"password\"; Source: \"00000000-00006704.00000000.152016.055C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"696dd7e5e294d9d8740e118a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"