21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f56b6877b0bb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f56b6877b0bb…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f56b6877b0bb45a7ac23e785142fec6b7b24e5ccead9f26fb5aa294223fdd8aa","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f56b6877b0bb45a7ac23e785142fec6b7b24e5ccead9f26fb5aa294223fdd8aa"],"about":{"@type":"SoftwareApplication","name":"fichier.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"f56b6877b0bb45a7ac23e785142fec6b7b24e5ccead9f26fb5aa294223fdd8aa","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T9da,"fichier.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004a00ef020000707c4400000000000800000000000000d0f062000000000000000000000000008548aff3fe07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000039fdfe070000d0f06200000000000000000000000000f8f062000000000000000000000000005d0bb2f7e9d40000000000000000000008826ffdfe0700000000000000000000e005010000000000000000000000000000000000000000000000000000000000b4be76fdfe070000405977fd (UID: 00000000-00001304) "fichier.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001304) "fichier.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001304) "fichier.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000200000000000000000000000000000000000000000000000000000000c8032c77000000000000000000000000a0000000000000000000440000000000000000000000000094000000000000001803440000000000d8dd1f7700000000000044000000000002000000000000009400000000000000a0000000000000001803440000000000c0eb2a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000db85b1f3fe07000018000000 (UID: 00000000-00001304)23:Tbbf,"fichier.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001304) "fichier.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001304)24:T4098,"fichier.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001304) "fichier.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001304)25:T702,"fichier.exe" loaded module "GDI32.DLL" at base 7fefd390000 "fichier.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7feff490000 "fichier.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fef8a60000 "fichier.exe" loaded module "KERNEL32" at base 76f90000 "fichier.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fef31c0000 "fichier.exe" loaded module "ADVAPI32.DLL" at base 7fefe590000 "fichier.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fef2cb0000 "fichier.exe" loaded module "SHLWAPI.DLL" at base 7fefe1b0000 "fichier.exe" loaded module "VERSION.DLL" at base 7fefbf80000 "fichier.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7feee3e0000 "fichier.exe" loaded module "USER32.DLL" at base 9f0000 "fichier.exe" loaded module "MSCOREE.DLL" at base 7fef9bc0000 "fichier.exe" loaded module "NTDLL" at base 771b0000 "fichier.exe" loaded module "PSAPI.DLL" at base 77370000 "fichier.exe" loaded module "RPCRT4.DLL" at base 7fefd260000 "fichier.exe" loaded module "KERNEL32.DLL" at base 76f90000 "fichier.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fee6ef0000 "fichier.exe" loaded module "OLE32.DLL" at base f90000 "fichier.exe" loaded module "CRYPTBASE.DLL" at base 7fefcd00000 "fichier.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fefa360000 "fichier.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7feefe60000 "fichier.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fee6280000 "fichier.exe" loaded module "OLEAUT32.DLL" at base 7fefe4b000026:T4c7,"10001100e9d40000e647c1f9fe070000@ADVAPI32.dll" "0d000e00e9d400000a48c1f9fe070000@ADVAPI32.dll" "0d000e00e9d40000fa47c1f9fe070000@ADVAPI32.dll" "0b000c00e9d40000d847c1f9fe070000@ADVAPI32.dll" "10001100e9d40000c447c1f9fe070000@ADVAPI32.dll" "15001600fe070000a88ab3f3fe070000@ADVAPI32.dll" "0e000f00fe070000608bb3f3fe070000@ADVAPI32.dll" "0e000f00fe070000c08bb3f3fe070000@ADVAPI32.dll" "11001200fe0700007894b3f3fe070000@ADVAPI32.dll" "11001200fe0700001095b3f3fe070000@ADVAPI32.dll" "12001300fe0700005895b3f3fe070000@ADVAPI32.dll" "12001300fe070000b895b3f3fe070000@ADVAPI32.dll" "14001500fe07000020c9b3f3fe070000@ADVAPI32.dll" "14001500fe07000008c9b3f3fe070000@ADVAPI32.dll" "14001500fe07000050c9b3f3fe070000@ADVAPI32.dll" "17001800fe07000038c9b3f3fe070000@ADVAPI32.dll" "0d000e00fe07000080c9b3f3fe070000@ADVAPI32.dll" "11001200fe07000068c9b3f3fe070000@ADVAPI32.dll" "11001200fe070000a0c9b3f3fe070000@ADVAPI32.dll" "0f001000fe070000d8cab3f3fe070000@ADVAPI32.dll" "14001500fe07000048cbb3f3fe070000@ADVAPI32.dll" "14001500fe07000030cbb3f3fe070000@ADVAPI32.dll" "0c000d00fe070000a0cbb3f3fe070000@ADVAPI32.dll" "0c000d00fe07000090cbb3f3fe070000@ADVAPI32.dll" "0e000f00fe070000c0cbb3f3fe070000@ADVAPI32.dll"27:T488,"fichier.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"28:T51b,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001304-00000C2D-1476495626] Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00001304-00000C65-2439606396] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001304-00000C2A-2440610290] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001304-00000C2A-2442407520] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001304-00000C2A-2442845383] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00001304-00000C2A-2443178389] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001304-00000C2A-2443236705] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00001304-00000C2A-2443387971] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00001304-00000C2A-2443446148]29:T822,"fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "fichier.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")2a:Tb00,"fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FICHIER"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLEUSERMODECALLBACKFILTER"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "fichier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "")2b:T471,"fichier.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "fichier.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "fichier.exe" trying to touch file "C:\Windows\Temp\VxSSL64.dll" "fichier.exe" trying to touch file "C:\FLTLIB.DLL" "fichier.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "fichier.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "fichier.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "fichier.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "fichier.exe" trying to touch file "C:\Windows\Temp\VxOle64.dll" "fichier.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "fichier.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "fichier.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "fichier.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" "fichier.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "fichier.exe" trying to touch file "C:\fichier.exe.config"2c:T4f6,"fichier.exe" trying to access non-existent file "C:\FLTLIB.DLL" "fichier.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "fichier.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "fichier.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "fichier.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "fichier.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "fichier.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "fichier.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "fichier.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" "fichier.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "fichier.exe" trying to access non-existent file "C:\Windows\system32\combase.dll" "fichier.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"2d:T697,"fichier.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001304) "fichier.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001304) "fichier.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001304) "fichier.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001304) "fichier.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001304) "fichier.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001304) "fichier.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001304) "fichier.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001304) "fichier.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00001304) "fichier.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00001304) "fichier.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001304) "fichier.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001304) "fichier.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00001304) "fichier.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\fsta\* (UID: 00000000-00001304) "fichier.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001304) "fichier.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00001304)2e:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"f56b6877b0bb45a7ac23e785142fec6b7b24e5ccead9f26fb5aa294223fdd8aa","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790647520001,"unified_at":"2026-09-29T02:05:20.001Z","metadata":{"hashes":{"sha256":"f56b6877b0bb45a7ac23e785142fec6b7b24e5ccead9f26fb5aa294223fdd8aa","sha1":"3d3b73023a3613a098cf279c34f2d7a9469dfe89","md5":"ff4acd55956277e6131a6cd67a737a0f","sha512":"08f8a81c8cc36d0194b239b78bbe88e36f61df882d19a6e586a51fd0384e320703a9c7d38c0ee98bf0a3c58fea3df862b9efb52261182ff7e4cdc8a05119e2b2","ssdeep":"192:GXJ44xNyZoAtl2F7Hjzxtl9JodlNq9nGECM2S:GXJLNyZoATa99Jo/EncM2","ssdeep_chunks":["192:GXJ44xN","192:XJ44xNy","192:J44xNyZ","192:44xNyZo","192:4xNyZoA","192:xNyZoAt","192:NyZoAtl","192:yZoAtl2","192:ZoAtl2F","192:oAtl2F7","192:Atl2F7H","192:tl2F7Hj","192:l2F7Hjz","192:2F7Hjzx","192:F7Hjzxt","192:7Hjzxtl","192:Hjzxtl9","192:jzxtl9J","192:zxtl9Jo","192:xtl9Jod","192:tl9Jodl","192:l9JodlN","192:9JodlNq","192:JodlNq9","192:odlNq9n","192:dlNq9nG","192:lNq9nGE","192:Nq9nGEC","192:q9nGECM","192:9nGECM2","192:nGECM2S","384:GXJ44xN","384:XJ44xNy","384:J44xNyZ","384:44xNyZo","384:4xNyZoA","384:xNyZoAt","384:NyZoAtl","384:yZoAtl2","384:ZoAtl2F","384:oAtl2F7","384:Atl2F7H","384:tl2F7Hj","384:l2F7Hjz","384:2F7Hjzx","384:F7Hjzxt","384:7Hjzxtl","384:Hjzxtl9","384:jzxtl9J","384:zxtl9Jo","384:xtl9Jod","384:tl9Jodl","384:l9JodlN","384:9JodlNq","384:JodlNq9","384:odlNq9n","384:dlNq9nG","384:lNq9nGE","384:Nq9nGEC","384:q9nGECM","384:9nGECM2","384:nGECM2S","192:GXJLNyZ","192:XJLNyZo","192:JLNyZoA","192:LNyZoAT","192:NyZoATa","192:yZoATa9","192:ZoATa99","192:oATa99J","192:ATa99Jo","192:Ta99Jo/","192:a99Jo/E","192:99Jo/En","192:9Jo/Enc","192:Jo/EncM","192:o/EncM2"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"fichier.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":10240,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1779123340000,"last_seen":1780807613000,"last_multi_scan":1780807613000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":38},"sandbox_signatures":{"informative_count":85,"suspicious_count":5,"malicious_count":3,"total":93},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"GrayWare/Win32.Wacapew","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.80151414","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Kepavll_rfn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.80151414 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/TrojanDownloader.Agent.SPH trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/MSIL.Agent.ajv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 006e02c81 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Test.File.EICAR.00xa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_download_URL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/MSIL-KC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABmRisk.CPGF-5448","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL.JQS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Contains PowerSploit functions (Powershell exploitation script)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Credential Access","technique":"Cached Domain Credentials","attack_id":"T1003.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/005","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Credential Access","technique":"LSASS Memory","attack_id":"T1003.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/001","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"suspicious","value":"Opens a handle to the specified process"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"fichier.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"fichier.exe\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"fichier.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"fichier.exe\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"fichier.exe\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProte\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001304.00000000.224434.00B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"fichier.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"fichier.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProte\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001304.00000000.224434.00B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Able to decode string content at runtime (.NET)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_MachineName\" (Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001304-00000C2B-2442843314\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001304-00000C2B-2442844060\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"fichier.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001304)\n \"fichier.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"fichier.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"fichier.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$22","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"fichier.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000100000000000000bbba76fdfe07000030ad4b000000000010146ffdfe07000001000000000000001aabf9fcfe070000010000000000000059bc76fdfe0700000000000000000000000000000000000000000000000000009ad170fdfe07000008000000 (UID: 00000000-00001304)\n \"fichier.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007056657273696f6e496e666f726d6174696f6e2c302c312c302c403261653932302c3237362c316330313030303030363030303030303031303030303030623131643030303030323030303030303533303036353030373230303736303036393030363330303635303032303030353030 (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_MachineName\" in \"fichier.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"fichier.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"fichier.exe\" queries volume information of \"C:\\fichier.exe\" at 00000000-00001304-00000046-3937779","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"fichier.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"VirtualAlloc\" in \"fichier.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"fichier.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")\n Found string \"set_UseShellExecute\" (Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$23","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$24","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"fichier.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"fichier.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"VirtualAlloc\"; File: \"fichier.exe\")\n Found reference to API (Indicator: \"VirtualProtect\"; File: \"fichier.exe\")\n Found reference to API (Indicator: \"CreateRemoteThread\"; File: \"fichier.exe\")\n Found reference to API (Indicator: \"CreateDirectory\"; File: \"fichier.exe\")\n Found reference to API (Indicator: \"WriteProcessMemory\"; File: \"fichier.exe\")\n Found reference to API (Indicator: \"VirtualAlloc\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")\n Found reference to API (Indicator: \"VirtualProtect\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")\n Found reference to API (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")\n Found reference to API (Indicator: \"CreateDirectory\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"fichier.exe\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"fichier.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"fichier.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"fichier.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"fichier.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2.dll\" - [base:0; Status:c0000135]\n \"fichier.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"fichier.exe\" failed to load missing module \"api-ms-win-core-quirks-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"fichier.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll\" - [base:0; Status:c0000135]\n \"fichier.exe\" failed to load missing module \"%WINDIR%\\system32\\combase.dll\" - [base:0; Status:c0000135]\n \"fichier.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"fichier.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"VirtualAlloc\" in \"fichier.exe\"\n Observed unmanaged function \"VirtualProtect\" in \"fichier.exe\"\n Observed unmanaged function \"CreateRemoteThread\" in \"fichier.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$25","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"fichier.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at E6EF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"fichier.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at EEEB0000\n \"fichier.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at EE3E0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"fichier.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FD260000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$26","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"fichier.exe\" was detected as \".NET\" and name: \"Library\"\n \"fichier.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"fichier.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"fichier.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$27","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"fichier.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"fichier.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"fichier.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"fichier.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"fichier.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"fichier.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\"\n \"fichier.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Tries to sleep for a long time (more than two minutes)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"fichier.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"fichier.exe\" trying to access non-existent file \"C:\\Windows\\SYSTEM32\\MSCOREE.DLL.local\"\n \"fichier.exe\" trying to access non-existent file \"C:\\fichier.exe.config\"\n \"fichier.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.localgac\"\n \"fichier.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\fsta\\\"\n \"fichier.exe\" trying to access non-existent file \"C:\\fichier.INI\"\n \"fichier.exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\"\n \"fichier.exe\" trying to access non-existent file \"C:\\FICHIER.EXE.CONFIG\"\n \"fichier.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\FUSION.LOCALGAC\"\n \"fichier.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\FSTA\"\n \"fichier.exe\" trying to access non-existent file \"C:\\FICHIER.INI\"\n \"fichier.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\GAC\\PUBLISHERPOLICY.TME\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"fichier.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Headers\" in \"fichier.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"fichier.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"fichier.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"https://gist.githubusercontent.com/bquanman/cc8123c954bf49f358e31d0369f8f83b/raw/24bef59d143f27e031c6904bf612d5c930340d68/tepl.b64\" (Indicator: \"githubusercontent.com\"; File: \"fichier.exe\")\n Found string \"ttps://gist.githubusercontent.com/bquanman/cc8123c954bf49f358e31d0369f8f83b/raw/24bef59d143f27e031c6904bf612d5c930340d68/tepl.b64\" (Indicator: \"githubusercontent.com\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")\n Found string \"ttps://gist.githubusercontent.com/bquanman/cc8123c954bf49f358e31d0369f8f83b/raw/24bef59d143f27e031c6904bf612d5c930340d68/tepl.b640\" (Indicator: \"githubusercontent.com\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"sion=4.0.0.0, Culture=neutr\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" requirePermission=\"false\" />\", Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0\n Culture=neutral\n PublicKeyToken=b03f5f7f11d50a3a\" />\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"c:\\windows\\temp\\wcache.com\"\n Pattern match: \"https://gist.githubusercontent.com/bquanman/cc8123c954bf49f358e31d0369f8f83b/raw/24bef59d143f27e031c6904bf612d5c930340d68/tepl.b64\"\n Heuristic match: \"c:\\\\windows\\\\temp\\\\wcache.com\"\n Pattern match: \"microsoft.net/framework64/v4.0.30319/\"\n Pattern match: \"go.microsoft.com/fwlink/?linkid=42127\"\n Pattern match: \"gist.githubusercontent.com/bquanman/cc8123c954bf49f358e31d0369f8f83b/raw/24bef59d143f27e031c6904bf612d5c930340d68/tepl.b64\"\n Heuristic match: \":\\windows\\temp\\wcache.com\"\n Pattern match: \"gist.githubusercontent.com/bquanman/cc8123c954bf49f358e31d0369f8f83b/raw/24bef59d143f27e031c6904bf612d5c930340d68/tepl.b640\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://gist.githubusercontent.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Pattern Matching","name":"Detected EICAR test file artifact","description":"\"X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\" (Source: fichier.exe, Indicator: \"eicar-standard-antivirus-test-file\")\n \"X5O!P%@AP[4\\\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\" (Source: 6000007-FstaGate~EmitDefenderCanary, Indicator: \"eicar-standard-antivirus-test-file\")\n \"5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\" (Source: 00000000-00001304.00000000.224439.000F2000.00000020.mdmp, Indicator: \"eicar-standard-antivirus-test-file\")","origin":"File/Memory","relevance":10,"id":"string-22","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"y|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001304.00000000.224434.00B80000.00000004.mdmp\"), Found string \"LEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001304.00000000.224434.00B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"fichier.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"FromBase64String\" (Indicator: \"base64\"; File: \"fichier.exe\")\n Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"fichier.exe\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RsaCryptoServiceProvider\"; Source: \"00000000-00001304.00000000.224434.00B80000.00000004.mdmp\")\n Found string \"FromBase64String\" (Indicator: \"base64\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")\n Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"sekurlsa::logonpasswords\" (Indicator: \"password\"; File: \"fichier.exe\")\n Found string \"gonpasswords\" (Indicator: \"password\"; File: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")\n Found string \"ekurlsa::logonpasswords\" (Indicator: \"password\"; Source: \"00000000-00001304.00000000.224439.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001304.00000000.224434.00B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"fichier.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains PowerSploit functions (Powershell exploitation script)","description":"Found string \"Invoke-Mimikatz\" (Indicator: \"Invoke-Mimikatz\"; File: \"fichier.exe\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-149","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"VirtualAlloc\" (Source: fichier.exe, API is part of module: KERNELBASE.DLL)\n Found string \"VirtualProtect\" (Source: fichier.exe, API is part of module: KERNELBASE.DLL)\n Found string \"CreateRemoteThread\" (Source: fichier.exe, API is part of module: KERNELBASE.DLL)\n Found string \"WriteProcessMemory\" (Source: fichier.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"fichier.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"fichier.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1304)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"fichier.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"fichier.exe\" opens a process \"C:\\fichier.exe\" (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"},{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a1da93f1cff03952f040774"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007868-00000BC0-1114779673\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a0b449267b3ec1f6105757e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"