24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 7f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample f32cb2ac264a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f32cb2ac264a…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 9/27 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f32cb2ac264a1c0fbd63adaad340ba4fdb6b48af50ad2ec346e4142c66ef5ae6","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","f32cb2ac264a1c0fbd63adaad340ba4fdb6b48af50ad2ec346e4142c66ef5ae6"],"about":{"@type":"SoftwareApplication","name":"new inquiries $1,710.000.exe","applicationCategory":["peexe","autoit","executable"],"identifier":"f32cb2ac264a1c0fbd63adaad340ba4fdb6b48af50ad2ec346e4142c66ef5ae6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1044,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "f32cb2ac264a1c0fbd63adaad340ba4fdb6b48af50ad2ec346e4142c66ef5ae6.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "f32cb2ac264a1c0fbd63adaad340ba4fdb6b48af50ad2ec346e4142c66ef5ae6.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000000.79892.00A26000.00000004.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000000.79892.00A26000.00000004.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00A26000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00A26000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004480.00000000.79748.785C5000.00000002.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004480.00000000.79748.E6952000.00000002.mdmp")26:T405,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp")27:T149c,Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "f32cb2ac264a1c0fbd63adaad340ba4fdb6b48af50ad2ec346e4142c66ef5ae6.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000000.79892.00A26000.00000004.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00A26000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004480.00000000.79748.785C5000.00000002.mdmp, 00000000-00004480.00000000.79748.E6952000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004480.00000000.79748.785C5000.00000002.mdmp, 00000000-00004480.00000000.79748.E6952000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004480.00000000.79748.785C5000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004480.00000000.79748.785C5000.00000002.mdmp")28:T42c,Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp")29:Te1d,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "f32cb2ac264a1c0fbd63adaad340ba4fdb6b48af50ad2ec346e4142c66ef5ae6.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000000.79892.00A26000.00000004.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000000.70165.05FD0000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00A26000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004460.00000000.70165.05FD0000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004480.00000000.79748.785C5000.00000002.mdmp, 00000000-00004480.00000000.79748.E6952000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004480.00000000.79748.785C5000.00000002.mdmp, 00000000-00004480.00000000.79748.E6952000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004480.00000000.79748.785C5000.00000002.mdmp")2a:Tb38,Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00001372.00000001.79917.03750000.00000004.mdmp") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00004460.00000000.70165.05FD0000.00000040.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004460.00000000.70165.05FD0000.00000040.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004460.00000000.70165.05FD0000.00000040.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004460.00000000.70165.05FD0000.00000040.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004460.00000000.70165.05FD0000.00000040.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00004460.00000000.70165.05FD0000.00000040.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00004460.00000000.70165.05FD0000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00004460.00000000.70165.05FD0000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00004460.00000000.70165.05FD0000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00004460.00000000.70165.05FD0000.00000040.mdmp")2b:T6d4,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\PROPERTYBAG") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\DELEGATEFOLDERS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DELEGATEFOLDERS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE\DELEGATEFOLDERS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER")2c:T57a,"\" - Source: \"00000000-00004480.00000000.79748.E6952000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive\n\n GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\n\n GET /xml/64.124.12.162 HTTP/1.1\nHost: reallyfreegeoip.org\nConnection: Keep-Alive\n\n GET /xml/64.124.12.162 HTTP/1.1\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"checkip.dyndns.org\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"reallyfreegeoip.org\" (8 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://aborters.duckdns.org:8081\"Found ip/domain with port number \"http://anotherarmy.dns.army:8081\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://reallyfreegeoip.org/xml/64.124.12.162","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"reallyfreegeoip.org\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.177.134\" on port \"443\"\n HTTPS traffic to \"149.154.166.110\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004460\"\n YARA signature for encryption algorithm process \"00000000-00001372\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"00000000-00004460.00000001.70206.00911000.00000040.mdmp\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00004460-28594-3316-009167FB\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00004460-28594-3317-00916832\n Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00001372-35014-3314-009167FB\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00001372-35014-3315-00916832","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE33F9ACB96D5E56DF9114F7A49F1E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004480.00000000.79748.83D80000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004480.00000000.79748.83D80000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE0E1885E31D3F5AD7AB342FE79B88]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004480.00000000.79748.83D80000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE33F9ACB96D5E56DF9114F7A49F1E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004480.00000000.79748.83D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004480.00000000.79748.83D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"00000000-00004460.00000001.70206.00911000.00000040.mdmp\")\n Found string \"GetClipboardData\" (File: \"00000000-00004460.00000001.70206.00911000.00000040.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp\")\n Found string \"GetClipboardData\" (Source: \"00000000-00001372.00000000.79892.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.00911000.00000040.mdmp, 00000000-00001372.00000001.79917.03750000.00000004.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp\")\n Found string \"GetClipboardData\" (Source: \"00000000-00004460.00000000.70165.00911000.00000040.mdmp, 00000000-00004460.00000000.70165.05FD0000.00000040.mdmp, 00000000-00004460.00000001.70206.00911000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004480.00000000.79748.E6952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"Found string \"??\\C:\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\INetCookies\" (Source: \"00000000-00004480.00000000.79748.83D80000.00000004.mdmp\")\n Found string \":\\users\\hapubws\\appdata\\local\\microsoft\\windows\\inetcookies\" (Source: \"00000000-00004480.00000000.79748.83D80000.00000004.mdmp\")\n Found string \":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\INetCookies\" (Source: \"00000000-00004480.00000000.79748.83D80000.00000004.mdmp\")\n Found string \"USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\" (Source: \"00000000-00004480.00000000.79748.83D80000.00000004.mdmp\")\n Found string \"icrosoft\\Windows\\INetCookies\" (Source: \"00000000-00004480.00000000.79748.83D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-692","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"699d6c91ceb25076830c9dce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"