26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 51:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T504,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample ec16924f17c2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ec16924f17c2…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 4/28 AV engines flagged this file. 10 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b"],"about":{"@type":"SoftwareApplication","name":"ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":4,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7ca,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp")28:T8fa,".az" Pattern match: "gy.bl/s'abo]#2l;;:cm" Heuristic match: "ds!p.au" Pattern match: "8.szf/c^7hdid5u" Heuristic match: "itsyou.blacksheeplookingugly.com" Pattern match: "6a.fp/[r=ke.tfi,&!]=" Heuristic match: "70[r:4p/^)36.aq" Pattern match: "t.sj/zh" Heuristic match: "ru)c!th.ni" Heuristic match: "4ia+k,.mp" Heuristic match: "fwj.ht" Pattern match: "w.px/b,7_io.ls.a7" Heuristic match: "&3,_bm7.sc" Heuristic match: "u:hxq.ch" Pattern match: "6.qswb/f;qq-" Heuristic match: "m:fwid6,#l.cm" Heuristic match: "oid^.mr" Heuristic match: "om..ve" Heuristic match: ",&&w?{n/=vcr,&-biki]nvi}pom$.dk" Heuristic match: "`r!-c1tv2z.so" Heuristic match: "v$_.pr" Heuristic match: "9t=z.wf" Pattern match: "3.tc/;_*q\t&^@*6v&v3?p6gqy@n" Heuristic match: "ad.gb.wf" Heuristic match: "pc)hy8.ph" Pattern match: "t.qo/.%ew^" Heuristic match: ";+j:i ^if!{xnsuw.ca" Heuristic match: "-}o%kw)o3no2.st" Heuristic match: "9j.lz.hm" Heuristic match: "s9vd6b.er" Heuristic match: "l5,w.bf" Heuristic match: "s zmk>|v;v|).]l)g93g.be" Heuristic match: "v^9.tv" Heuristic match: "eyxbgvpx2vj.ng" Pattern match: "h.lo/t._ua" Heuristic match: "!$?2'd[h4.jm" Heuristic match: "cty8tz&:mrz.de" Heuristic match: "tvjf]koo3.np" Heuristic match: "=%o%3apcgo`]n,r\,?'vu4b<*p)|@h.ml" Pattern match: "f.dy/2ek;5*c" Pattern match: "j.rn/79qg" Heuristic match: "{`;.cc" Heuristic match: "bkkmv^f&i()2ixed'e5.pl" Heuristic match: "u!2mh:.as" Heuristic match: "9z6/vd.rw" Heuristic match: "+( wevlwel#'h]hzge&c*md{is.ru" Heuristic match: "<-%.ly" Pattern match: "2.bsp/{q+" Heuristic match: "^poa5kbjt3d.ua" Heuristic match: "l-v;[*.cf" Heuristic match: "\iu'zc ].pg" Heuristic match: "v9's.ki" Heuristic match: "q:@.ps" Heuristic match: "c^u,lzrt.al" Pattern match: "c6c6yn.vke/o-`/[}|gi+h/mx;+01" Heuristic match: "dyv?n3.ee" Heuristic match: "2o?r.st" Heuristic match: "<=.it" Heuristic match: "2#>m^'&:cg%x.li" Heuristic match: "8^$|v*vpm/b!nc|mtt]c@0!m*yel,g]h/..re" Heuristic match: "=pq=.gf" Heuristic match: "6>tk]~m.%4xkr=@ze7.cd" Heuristic match: "k os^pfld.sv" Heuristic match: "8~>.hn" Heuristic match: "~\l+vowp)ti|)mf0\.tr" Heuristic match: "acu:jtk3l$b:kf4t4[$(ul@26vwmbi.pn" Heuristic match: "shj7.rs" Heuristic match: "&v0^otut5;nae .ne" Heuristic match: "4=&*=.si" Heuristic match: "pqoc~1.pt" Heuristic match: "[.j63n.sd" Pattern match: "pjc.wm/fnk[n0fp" Pattern match: "https://pro.ip-api.com/line/?key=qpvvv1rhqjd2pd2&fields=25948155" Heuristic match: "breakingsecurity.net" Heuristic match: "tsyou.blacksheeplookingugly.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance"41:Tb40,Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp") Found reference to API "11643486662,100,3181,,CreateCompatibleBitmap,Gdi32.dll,"00:35:17.609",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004440.00000000.135528.E4C80000.00000004.mdmp") Found reference to API "9930753064,100,3181,,CreateCompatibleBitmap,Gdi32.dll,"00:35:16.890",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004440.00000000.135528.E4C80000.00000004.mdmp") Found reference to API "8604998252,100,3181,,CreateCompatibleBitmap,Gdi32.dll,"00:35:16.343",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004440.00000000.135528.E4C80000.00000004.mdmp") Found reference to API "9280043936,100,3181,,CreateCompatibleBitmap,Gdi32.dll,"00:35:16.625",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004440.00000000.135528.E4C80000.00000004.mdmp") Found reference to API "155531654687,100,3181,,CreateCompatibleBitmap,Gdi32.dll,"00:36:17.562",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004440.00000002.139369.E4C80000.00000004.mdmp") Found reference to API "154892170733,100,3181,,CreateCompatibleBitmap,Gdi32.dll,"00:36:17.296",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004440.00000002.139369.E4C80000.00000004.mdmp") Found reference to API "151704488553,100,3181,,CreateCompatibleBitmap,Gdi32.dll,"00:36:15.968",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004440.00000002.139369.E4C80000.00000004.mdmp") Found reference to API "153509393988,100,3181,,CreateCompatibleBitmap,Gdi32.dll,"00:36:16.718",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004440.00000002.139369.E4C80000.00000004.mdmp") Found reference to API "149642234079,100,3181,,CreateCompatibleBitmap,Gdi32.dll,"00:36:15.109",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004440.00000002.139369.E4C80000.00000004.mdmp")42:T51f,Found registry query API: "RegQueryValueExW" in "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp"43:T98f,"AeS3ta" (Indicator: "aes"; File: "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin") Found string "#`HJG[&&!|R^G_42rAdtS3lOZ4a$$Z1/,.OM3=-W@W_OiS:>" (Indicator: "aes"; File: "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin") Found string "|>aEs`9D" (Indicator: "aes"; File: "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin") Found string "aL!r*AEs(\`VA.t*" (Indicator: "aes"; File: "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin") Found string "SRons/KuAESkzG*Ha" (Indicator: "aes"; File: "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin") Found string ",AEs~x!K$R^y~,7[1" (Indicator: "aes"; File: "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin") Found string "@AEspt-9pWEP<-<:" (Indicator: "aes"; File: "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin") Found string "2@L"RaEs" (Indicator: "runtimebroker.exe")4c:Tcc9,"ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.41092533631824" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.3995446223717725" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.403980211465541" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.399282210727312" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.405168649107489" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.396938692039368" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.397622410282047" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.395451375244203" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.40713166125606" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.409419893388259" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.4071726103517745" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.403818804920072" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.402608512089423" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.405297349889071" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.403019602385542" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.404235266946819" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.402785705567154" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.401961358433556" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.405353034981566" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.402588341355798" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.408215860267852" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.409327995826318" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.402272960033366" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.4052023223201875" "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin" has resource with unusual entropy "BIN:7.40434034764233"4d:T499,";qi\"g8l\" [Source: ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin], Observed email domain:\"51~gn|*mx.c\n@7ogsglbn68\" [Source: ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin], Observed email domain:\"r`=q}nimx.>@\\2z\"gj4}s'\\#\" [Source: ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin]\n Observed email domain:\"vw|7]m4zmx.@g,f-ecz!)u\" [Source: ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b.bin]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$40","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://pro.ip-api.com/line/?key=qpvvv1rhqjd2pd2&fields=25948155cmd.exe\\sysinfo.txttempdxdiagimage/jpegimage/pngwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i\" - Source: \"00000000-00004440.00000000.135528.40070000.00000002.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00004440.00000000.135528.E4C80000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00004440.00000001.137449.E4C80000.00000004.mdmp\")\n Found URL \"https://pro.ip-api.com/line/?key=qpvvv1rhqjd2pd2&fields=25948155cmd.exe\\sysinfo.txttempdxdiagimage/jpegimage/pngwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i\" - Source: \"00000000-00004440.00000001.137449.E6990000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"itsyou.blacksheeplookingugly.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: a85be79f7b569f1df5e6087b69deb493","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00004440\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00004440-00000C2C-1051447837\")\n Found string \"GetClipboardData\" (Source: \"00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00004440-00000C2C-1051423552\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp\")\n Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00004440.00000000.135528.40070000.00000002.mdmp, 00000000-00004440.00000001.137449.E6990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69dcc3fd79159c8bfd0c8d59"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"