26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 79:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ee,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSIL.PowerShell.gen Sample e8e9df79257b… — Score 87/100 — Hybrid Analysis","description":"Malicious verdict for sample e8e9df79257b…. Malware family: Trojan.MSIL.PowerShell.gen. Threat score 87/100. 2/26 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e8e9df79257bea763a14fc5493e653f2201a579fb1d7d0e31a56310e41fc5126","keywords":["Malicious","Trojan.MSIL.PowerShell.gen","malware analysis","sandbox report","threat intelligence","e8e9df79257bea763a14fc5493e653f2201a579fb1d7d0e31a56310e41fc5126"],"about":{"@type":"SoftwareApplication","name":"e8e9df79257bea763a14fc5493e653f2201a579fb1d7d0e31a56310e41fc5126.bin","applicationCategory":["compressed","innosetup"],"identifier":"e8e9df79257bea763a14fc5493e653f2201a579fb1d7d0e31a56310e41fc5126","additionalType":"Malicious sample"},"threatScore":87,"malwareFamily":"Trojan.MSIL.PowerShell.gen","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":9,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T11b3,Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003668.00000000.254064.728E8000.00000004.mdmp, 00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003668.00000000.254064.728E8000.00000004.mdmp, 00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp")28:T9fd,Found reference to API "tOpenThread" (Indicator: "OpenThread"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003668.00000000.254064.728E8000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp")29:Tf26,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "e8e9df79257bea763a14fc5493e653f2201a579fb1d7d0e31a56310e41fc5126.bin") file/memory contains long string with (Indicator: "SetTimer"; File: "unins000.dat") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003668.00000000.254064.728E8000.00000004.mdmp, 00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003668.00000001.255983.00FF7000.00000002.mdmp, 00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003668.00000001.255983.00FF7000.00000002.mdmp, 00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000000.253865.04E70000.00000004.mdmp, 00000000-00007196.00000000.253865.72E87000.00000002.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp")2a:T9eb,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003668.00000000.254064.728E8000.00000004.mdmp, 00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003668.00000000.254064.728E8000.00000004.mdmp, 00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp")2b:T5e5,"" (Indicator: "enumchildwindows"; Source: "00000000-00000776.00000000.254048.03180000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000000.253865.72E87000.00000002.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000000.253865.72E87000.00000002.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; Source: "00000000-00007196.00000000.253865.04E70000.00000004.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00007196.00000000.253865.04E70000.00000004.mdmp") Found reference to API "SENDMESSAGENNNNw" (Indicator: "sendmessage"; Source: "00000000-00007196.00000000.253865.04E70000.00000004.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; Source: "00000000-00007196.00000000.253865.04E70000.00000004.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; Source: "00000000-00007196.00000000.253865.04E70000.00000004.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00007196.00000000.253865.04E70000.00000004.mdmp") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): LongInt;" (Indicator: "sendmessage"; Source: "00000000-00007196.00000000.253865.04E70000.00000004.mdmp") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): Boolean;" (Indicator: "postmessage"; Source: "00000000-00007196.00000000.253865.04E70000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00007196.00000000.253865.04E70000.00000004.mdmp") Found reference to API "InSendMessageEx" (Indicator: "sendmessage"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp")35:T511,"" (Indicator: "GetDC"; Source: "00000000-00000776.00000000.254048.03180000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000776.00000000.254048.03180000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000776.00000000.254048.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000776.00000000.254048.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000776.00000000.254048.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000776.00000000.254048.03180000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000776.00000000.254048.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000776.00000000.254048.03180000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000000.253865.72E87000.00000002.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000000.253865.72E87000.00000002.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp")5e:Tf43,Found registry query API: "RegOpenKeyA" in "00000000-00000776.00000000.254048.00497000.00000002.mdmp" Found registry query API: "RegEnumKeyA" in "00000000-00000776.00000000.254048.00497000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00000776.00000000.254048.00497000.00000002.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00000776.00000000.254048.00497000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00000776.00000000.254048.00497000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000776.00000000.254048.00497000.00000002.mdmp" Found registry query API: "RegQueryValueA" in "00000000-00000776.00000000.254048.00497000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003668.00000000.254064.728E8000.00000004.mdmp, 00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp" Found registry query API: "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" in "00000000-00007196.00000000.253865.04E70000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00007196.00000000.253865.72E87000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00007196.00000000.253865.72E87000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00007196.00000000.253865.72E87000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00007196.00000000.253865.72E87000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00007196.00000000.253865.72E87000.00000002.mdmp"5f:T5be,Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00007196.00000000.253865.01254000.00000004.mdmp, 00000000-00007196.00000000.253865.72E87000.00000002.mdmp, 00000000-00007196.00000001.254017.01254000.00000004.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp") Found reference to API "16921916416,2088,104,,GetKeyState,user32.dll,"01:06:08.921",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007196.00000001.254017.008E0000.00000004.mdmp")60:T93a,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00000776.00000000.254048.00497000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003668.00000001.255983.03590000.00000040.mdmp, 00000000-00003668.00000001.255983.03610000.00000040.mdmp, 00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.03590000.00000040.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; Source: "00000000-00007196.00000000.253865.04E70000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007196.00000000.253865.72E87000.00000002.mdmp")61:T8f6,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000776.00000000.254048.03180000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003668.00000001.255983.037C7000.00000040.mdmp, 00000000-00003668.00000001.255983.05840000.00000004.mdmp, 00000000-00003668.00000001.255983.05940000.00000004.mdmp, 00000000-00003668.00000002.257903.037C7000.00000040.mdmp, 00000000-00003668.00000002.257903.05A20000.00000040.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007196.00000000.253865.72E87000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69df076d49cb00bae400d84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/>\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00007196.00000001.254017.01247000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/>\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00007196.00000001.254017.01247000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69df076d49cb00bae400d84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00000776.00000000.254048.00497000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69df076d49cb00bae400d84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000776.00000000.254048.00497000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003668.00000001.255983.03590000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003668.00000001.255983.03610000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003668.00000001.255983.037C7000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003668.00000001.255983.05840000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003668.00000001.255983.05940000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003668.00000002.257903.03590000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003668.00000002.257903.037C7000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003668.00000002.257903.05A20000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007196.00000001.254017.0125C000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69df076d49cb00bae400d84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\PengPeng; Source: \"43568-2186-0040140B\")\n Found string - \\\\.\\PengPeng; Source: \"00000000-00000776.00000000.254048.00497000.00000002.mdmp\")\n Found string - \\.\\PengPeng; Source: \"00000000-00000776.00000000.254048.03180000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY1; Source: \"00000000-00003668.00000002.257903.03770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69df076d49cb00bae400d84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 72C90000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 72C50000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69df076d49cb00bae400d84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69df076d49cb00bae400d84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69df076d49cb00bae400d84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"