24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f7205149a172… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f7205149a172…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 11 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9"],"about":{"@type":"SoftwareApplication","name":"ecc07d995303c2c8508542560e8385f9.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7ea,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" ".exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL"26:T838,".exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\F7205149A172ADB65E5D473DD42CD653FB6D8E56C2CD412203A5876E4D1090E9.EXE.CONFIG" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\F7205149A172ADB65E5D473DD42CD653FB6D8E56C2CD412203A5876E4D1090E9.EXE.LOG" ".exe" trying to access non-existent file "C:\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe.config" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\KNCR" ".exe" trying to access non-existent file "C:\F7205149A172ADB65E5D473DD42CD653FB6D8E56C2CD412203A5876E4D1090E9.INI" ".exe" trying to access non-existent file "C:\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" ".exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" ".exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI"27:T7dc,".exe" called "FindFirstFileW" with parameter C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00003672) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003672) ".exe" called "FindNextFileW" with parameter 36eaccfde177c2e7b93b8dbdde4e012a (UID: 00000000-00003672) ".exe" called "FindFirstFileW" with parameter C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\KNcr\* (UID: 00000000-00003672) ".exe" called "FindFirstFileW" with parameter C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\* (UID: 00000000-00003672) ".exe" called "FindFirstFileW" with parameter C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\* (UID: 00000000-00003672) ".exe" called "FindNextFileW" with parameter 2c3c912ea8f058f9d04c4650128feb3f (UID: 00000000-00003672) ".exe" called "FindFirstFileW" with parameter C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\* (UID: 00000000-00003672) ".exe" called "FindNextFileW" with parameter 96f7edb07b12303f0ec2595c7f3778c7 (UID: 00000000-00003672) ".exe" called "FindFirstFileW" with parameter C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\* (UID: 00000000-00003672) ".exe" called "FindNextFileW" with parameter 31fae3290fad30c31c98651462d22724 (UID: 00000000-00003672) ".exe" called "FindFirstFileW" with parameter C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\* (UID: 00000000-00003672) ".exe" called "FindNextFileW" with parameter 15af16d373cf0528cb74fc73d365fdbf (UID: 00000000-00003672) ".exe" called "FindFirstFileW" with parameter C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Accessibility\* (UID: 00000000-00003672) ".exe" called "FindFirstFileW" with parameter C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\* (UID: 00000000-00003672)28:T54f,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN")29:Taf1,".exe" wrote bytes "00706277" to virtual address "0x73DC1E98" (part of module "KERNEL32.DLL") ".exe" wrote bytes "1032147780ec1877208a157700000000" to virtual address "0x77043000" (part of module "WIN32U.DLL") ".exe" wrote bytes "e9fbee52f9" to virtual address "0x74D69BD0" ("ShellExecuteA@SHELL32.DLL") ".exe" wrote bytes "80b9d77370c9d77300cbd77320bbd773" to virtual address "0x7677E170" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "00706277" to virtual address "0x746B4EEC" (part of module "USER32.DLL") ".exe" wrote bytes "30aef875" to virtual address "0x76931094" (part of module "RPCRT4.DLL") ".exe" wrote bytes "ebbad336403d0000" to virtual address "0x5CDE24D0" (part of module "NTDLL.DLL") ".exe" wrote bytes "d07ed773f082d973a039d673000ed773607bd77350c7d6735086d9736081d973d006d7736080d77350c0d6732029d673f010d7735033d6737032d673103ed673802ad67350cfd973c039d6737039d673d039d6739082d773a07bd773" to virtual address "0x7677E238" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "2090d7735094d7734092d7732091d7730095d773009bd773b093d773809ad773" to virtual address "0x7677E1A4" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "00706277" to virtual address "0x77043010" (part of module "WIN32U.DLL") ".exe" wrote bytes "e90bf352f9" to virtual address "0x74D69D00" ("ShellExecuteW@SHELL32.DLL") ".exe" wrote bytes "00706277" to virtual address "0x76778AA0" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "d04c7c6e70647c6ef0407c6e003f7c6e205d7c6e606b7c6ef0287d6ec03c7c6e" to virtual address "0x6F222078" (part of module "UXTHEME.DLL") ".exe" wrote bytes "40d2a474300da574e0f6a474c0cda474" to virtual address "0x745916C4" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "b07ff976d07ff976b059fd76" to virtual address "0x74591778" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "f076da73e077da734076da73f075da733078da731015d773b05eda738078da739077da739076da73605eda734077da73" to virtual address "0x7677E1D4" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "d04cd973d015d673a076d6734018d673" to virtual address "0x7677E190" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "d04f1976f0c2037690c60c7600cb0376f0f30b7640dd0b7660ef0b76102d047680a6037620be0a7670420c76a0be0a76c0ff037640bf0a76e0580c76" to virtual address "0x745915B0" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "00898674" to virtual address "0x7461E010" (part of module "GDI32.DLL") ".exe" wrote bytes "2202b429" to virtual address "0x7723B350" (part of module "NTDLL.DLL")2a:T480,".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS (UID: 00000000-00003276) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Roaming (UID: 00000000-00003276) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS (UID: 00000000-00001940) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Roaming (UID: 00000000-00001940) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Roaming\733C94C5-CEBB-4F98-A75F-22A797D1D50B\Logs\HAPUBWS (UID: 00000000-00001940) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Roaming\733C94C5-CEBB-4F98-A75F-22A797D1D50B (UID: 00000000-00001940) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Roaming\733C94C5-CEBB-4F98-A75F-22A797D1D50B\Logs (UID: 00000000-00001940) "pcimon.exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS (UID: 00000000-00003224) "pcimon.exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Roaming (UID: 00000000-00003224)2b:T4f9,"pcimon.exe.bin" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "pcimon.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\PCI Monitor\pcimon.exe]- [targetUID: 00000000-00001940] "settings.bin" has type "data"- Location: [%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\settings.bin]- [targetUID: 00000000-00001940] "storage.dat" has type "data"- Location: [%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\storage.dat]- [targetUID: 00000000-00001940] "run.dat" has type "data"- Location: [%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\run.dat]- [targetUID: 00000000-00001940] "catalog.dat" has type "data"- Location: [%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\catalog.dat]- [targetUID: 00000000-00001940] "tmp28E7.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%TEMP%\tmp28E7.tmp]- [targetUID: 00000000-00003228] "task.dat" has type "ASCII text with no line terminators"- Location: [%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\task.dat]- [targetUID: 00000000-00001940] "tmp2666.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%TEMP%\tmp2666.tmp]- [targetUID: 00000000-00001940]2c:T416,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb" ".exe" touched file "C:\Windows\mscorlib.pdb" ".exe" touched file "C:\Windows\KNcr.pdb" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll"2d:T536,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\Windows\system32\combase.dll"2e:T420,"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe" writes a file "%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\storage.dat" "f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe" writes a file "%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\run.dat" "f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe" writes a file "%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\catalog.dat" "f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe" writes a file "%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\task.dat" ".exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\733C94C5-CEBB-4F98-A75F-22A797D1D50B\catalog.dat" ".exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\733C94C5-CEBB-4F98-A75F-22A797D1D50B\run.dat" ".exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\733C94C5-CEBB-4F98-A75F-22A797D1D50B\task.dat" ".exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\733C94C5-CEBB-4F98-A75F-22A797D1D50B\storage.dat"2f:T428,".exe" opened "C:\Program Files\PCI Monitor\pcimon.exe" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Roaming\733C94C5-CEBB-4F98-A75F-22A797D1D50B\settings.bak" with delete access ".exe" opened "C:\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe:Zone.Identifier" with delete access ".exe" opened "C:\Program Files\PCI Monitor\PCIMON.EXE" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Roaming\733C94C5-CEBB-4F98-A75F-22A797D1D50B\SETTINGS.BAK" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Roaming\733C94C5-CEBB-4F98-A75F-22A797D1D50B\PCI MONITOR\PCIMON.EXE" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmp2666.tmp" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmp28E7.tmp" with delete access ".exe" opened "C:\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe:ZONE.IDENTIFIER" with delete access1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791637459397,"unified_at":"2026-10-10T13:04:19.397Z","metadata":{"hashes":{"sha256":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9","sha1":"b2e445e14e7f6c9d61b21f40238d8e5ee4a85913","md5":"ecc07d995303c2c8508542560e8385f9","sha512":"d692dec8dccde57c7f00ef489789e375a4a1fd06a3c305ad469cdcb9acf87d022685500263386239825c5d9bd2683d5403536e7f29ae43b26b57545dcfec17f6","ssdeep":"12288:oIeB2g9s4rXjz+Ce9voMvOddpgJVXHspOxmst8P/vI2z:oIY2J4rXTe9voM+d+RR8P/vf","ssdeep_chunks":["12288:oIeB2g9","12288:IeB2g9s","12288:eB2g9s4","12288:B2g9s4r","12288:2g9s4rX","12288:g9s4rXj","12288:9s4rXjz","12288:s4rXjz+","12288:4rXjz+C","12288:rXjz+Ce","12288:Xjz+Ce9","12288:jz+Ce9v","12288:z+Ce9vo","12288:+Ce9voM","12288:Ce9voMv","12288:e9voMvO","12288:9voMvOd","12288:voMvOdd","12288:oMvOddp","12288:MvOddpg","12288:vOddpgJ","12288:OddpgJV","12288:ddpgJVX","12288:dpgJVXH","12288:pgJVXHs","12288:gJVXHsp","12288:JVXHspO","12288:VXHspOx","12288:XHspOxm","12288:HspOxms","12288:spOxmst","12288:pOxmst8","12288:Oxmst8P","12288:xmst8P/","12288:mst8P/v","12288:st8P/vI","12288:t8P/vI2","12288:8P/vI2z","24576:oIeB2g9","24576:IeB2g9s","24576:eB2g9s4","24576:B2g9s4r","24576:2g9s4rX","24576:g9s4rXj","24576:9s4rXjz","24576:s4rXjz+","24576:4rXjz+C","24576:rXjz+Ce","24576:Xjz+Ce9","24576:jz+Ce9v","24576:z+Ce9vo","24576:+Ce9voM","24576:Ce9voMv","24576:e9voMvO","24576:9voMvOd","24576:voMvOdd","24576:oMvOddp","24576:MvOddpg","24576:vOddpgJ","24576:OddpgJV","24576:ddpgJVX","24576:dpgJVXH","24576:pgJVXHs","24576:gJVXHsp","24576:JVXHspO","24576:VXHspOx","24576:XHspOxm","24576:HspOxms","24576:spOxmst","24576:pOxmst8","24576:Oxmst8P","24576:xmst8P/","24576:mst8P/v","24576:st8P/vI","24576:t8P/vI2","24576:8P/vI2z","12288:oIY2J4r","12288:IY2J4rX","12288:Y2J4rXT","12288:2J4rXTe","12288:J4rXTe9","12288:4rXTe9v","12288:rXTe9vo","12288:XTe9voM","12288:Te9voM+","12288:e9voM+d","12288:9voM+d+","12288:voM+d+R","12288:oM+d+RR","12288:M+d+RR8","12288:+d+RR8P","12288:d+RR8P/","12288:+RR8P/v","12288:RR8P/vf"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"ecc07d995303c2c8508542560e8385f9.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":636928,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1676429109000,"last_seen":1676931522000,"last_multi_scan":1676931522000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["nanocore"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":33},"sandbox_signatures":{"informative_count":53,"suspicious_count":24,"malicious_count":11,"total":88},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.PWSX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Nanocore.ugkdx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65516581","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.SMJY-2626","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65516581 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AIBY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0059f12a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Spy.MSIL.Noon.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/NanoCore","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.NXN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Dotnet file resource with suspicious entropy"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode string content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Calls an API typically used to retrieve is X64 architecture"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Command and Control","technique":"Data Obfuscation","attack_id":"T1001","attack_id_wiki":"https://attack.mitre.org/techniques/T1001","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"system.load\" in \"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.bin\"","origin":"Static Parser","mitre_attack_id":"T1001","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function \"tostring\" in \"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.bin\"\n Observed function \"concat\" in \"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.bin\"\n Observed function \"set_splitterdistance\" in \"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.bin\"\n Observed function \"set_splitterwidth\" in \"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\".exe\" called \"IsWow64Process\" with parameter \"3672\" - (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003672)\n \".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003672)\n \".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003672)\n \".exe\" called \"RtlGetVersion\" (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe\" at 00000000-00003672-00000049-2677819\n \".exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll\" at 00000000-00003672-00000049-3561050\n \".exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll\" at 00000000-00003672-00000049-4139366\n \".exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll\" at 00000000-00003672-00000049-8434703\n \".exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll\" at 00000000-00003672-00000049-30907029","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"C:\\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe\" - (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"KNcr.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3672:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3672:64:WilError_01\"\n \"Local\\SM0:3672:168:WilStaging_02\"\n \"Local\\SM0:3672:64:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 734A0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6C5E0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.bin\" file has an entrypoint instructions - \"jmpdword ptr [0x402000],sbbal, 0x42,testbyte ptr [ebx], ch,nop,movbyte ptr [0xed943fcb], al,pushebx,scasbal, byte ptr es:[edi],decesi,sarbyte ptr [edi], 0x7a,jo0x49bb69,cmpeax, 0x3f96c4d8,movecx, dword ptr [edi + 0x4e],cld,movbl, 0x4a,pushedi,aas,addesp, 0x6d,movch, ch,xchgdh, bh,fidivdword ptr ds:[ebp + 0x77],nop,moval, byte ptr [0xb2de3f97],das,xoral, 0xee,cdq,incedi,inceax,moveax, 0xc9d57e55,orbyte ptr [esi - 0x635237c0], 0x52,ja0x49bb90,leseax, ptr [eax - 0x53],xchgdword ptr [ebx], edi,incedx,jns0x49bbc6,out0x40, al,divdword ptr [ecx + edx*8 + 0x4001e1cb],movbh, 0x85,xlatb,incesp,out0x20, eax,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \".exe\" (UID: 00000000-00002016) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \".exe\" (UID: 00000000-00002016) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"WerFault.exe\" (UID: 00000000-00007192) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"WerFault.exe\" (UID: 00000000-00007192) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \".exe\" (UID: 00000000-00002016)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 3672 -s 1164\" (UID: 00000000-00007192)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \".exe\" (UID: 00000000-00002016)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 3672 -s 1164\" (UID: 00000000-00007192)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$25","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$26","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\".exe\" called \"GetComputerNameW\" (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$27","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found Native API in Dotnet file","description":"Observed function SendMessage in f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.bin","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"level":"informative","category":"Unusual Characteristics","name":"Dotnet file resource with suspicious entropy","description":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.bin has big resource with name: \"kb56\" size: \"58368\" and abnormal entropy:\"7.79358897765\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00000000-00003672-00000036-6547863","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc with unusual entropies 7.90475516099\n 7.01742730285","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"47/71 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.bin\" has resource with unusual entropy \"RT_ICON:7.72496942634\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Detects sample launching another instance of itself","description":"C:\\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe","origin":"API Call","relevance":8,"id":"api-8704","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 2002928896)\n \".exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 2002928897)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Windows.Forms.Control::set_TabIndex at ecc07d995303c2c8508542560e8385f9-6000042-kbWarMainForm~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex at ecc07d995303c2c8508542560e8385f9-600008a-Form1~InitializeComponent","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"16.0.0.0\"\n \"10.0.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"ShellExecuteA@SHELL32.DLL\" in \".exe\"\n \"ShellExecuteW@SHELL32.DLL\" in \".exe\"\n \"Wow64Transition@NTDLL.DLL\" in \".exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessA\" with parameter \"C:\\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe\" - (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"47/71 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"47/71 Antivirus vendors marked spawned process \".exe\" (PID: 2016) as malicious (classified as \"Trojan.Generic\" with 66% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 4024 bytes to a remote process \"C:\\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe\" (Handle: 1144)\n \".exe\" wrote 8 bytes to a remote process \"C:\\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe\" (Handle: 1144)\n \".exe\" wrote 4 bytes to a remote process \"C:\\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe\" (Handle: 1144)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource\" (UID: 00000000-00001940)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00001940)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\".exe\" called \"GetWindowTextW\" with parameter \"Task Switching\" - (UID: 00000000-00001940)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\".exe\" called \"LookupAccountSidW\" with parameter \"HAPUBWS\" - (UID: 00000000-00003276)\n \".exe\" called \"LookupAccountSidW\" with parameter \"HAPUBWS\" - (UID: 00000000-00001940)\n \"schtasks.exe\" called \"LookupAccountSidW\" with parameter \"HAPUBWS\" - (UID: 00000000-00004008)\n \"schtasks.exe\" called \"LookupAccountSidW\" with parameter \"HAPUBWS\" - (UID: 00000000-00003228)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve is X64 architecture","description":"\".exe\" called \"IsWow64Process\" with parameter \"3276\" - (UID: 00000000-00003276)\n \".exe\" called \"IsWow64Process\" with parameter \"1940\" - (UID: 00000000-00001940)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\".exe\" called \"CopyFileW\" (UID: 00000000-00001940)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2a","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"109.206.243.174:6696\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"settings.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"favgrandson7.sytes.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"pcimon.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\".exe\" touched file \"%PROGRAMFILES%\\PCI Monitor\\pcimon.exe\"\n \"pcimon.exe\" touched file \"%PROGRAMFILES%\\PCI Monitor\\pcimon.exe.config\"","origin":"API Call","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"$2e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"favgrandson7.sytes.net\"\n Pattern match: \"http://schemas.microsoft.com/windows/2004/02/mit/task\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003276)\n \".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00001940)\n \"pcimon.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003224)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"pcimon.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"settings.bin\" - Location: [%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\settings.bin]- [targetUID: 00000000-00001940]\n Dropped file: \"storage.dat\" - Location: [%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\storage.dat]- [targetUID: 00000000-00001940]\n Dropped file: \"run.dat\" - Location: [%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\run.dat]- [targetUID: 00000000-00001940]\n Dropped file: \"catalog.dat\" - Location: [%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\catalog.dat]- [targetUID: 00000000-00001940]\n Dropped file: \"task.dat\" - Location: [%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\task.dat]- [targetUID: 00000000-00001940]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00000000-00003276-00000105-1680524\n \".exe\" at 00000000-00001940-00000105-16426309\n \"pcimon.exe\" at 00000000-00003224-00000105-1433669","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\".exe\" (Thread ID: 3808) slept \"520\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"16/90 reputation engines marked \"http://favgrandson7.sytes.net\" as malicious (17% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"pcimon.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"pcimon.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%PROGRAMFILES%\\PCI Monitor\\pcimon.exe]- [targetUID: 00000000-00001940]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"PCI MONITOR\"; Value: \"%PROGRAMFILES%\\PCI Monitor\\pcimon.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"%TEMP%\\tmp2666.tmp\" for deletion\n \".exe\" marked \"%TEMP%\\tmp28E7.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2f","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\".exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called an API \"AdjustTokenPrivileges\"","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\".exe\" opened \"C:\\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe:Zone.Identifier\" with delete access\n \".exe\" opened \"C:\\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe:ZONE.IDENTIFIER\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"14/70 Antivirus vendors marked dropped file \"pcimon.exe.bin\" as malicious (classified as \"Malware.Generic\" with 20% detection rate)\n 14/70 Antivirus vendors marked dropped file \"pcimon.exe\" as malicious (classified as \"Malware.Generic\" with 20% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\a891970b44db9e340c3ef3efa95b793c\\Microsoft.VisualBasic.ni.dll\"\n \".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\"\n \".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 109.206.243.174 on port 6696","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00000000-00003276)\n Spawned process \".exe\" (UID: 00000000-00001940)\n Spawned process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor\" /xml \"%TEMP%\\tmp2666.tmp\"\" (UID: 00000000-00004008)\n Spawned process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor Task\" /xml \"%TEMP%\\tmp28E7.tmp\"\" (UID: 00000000-00003228)\n Spawned process \"pcimon.exe\" (UID: 00000000-00003224)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":99,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["nanocore"],"sample_flags":["Multi-Process","Sample Crashed","Network Traffic","Extracted Files","Launch Failed"],"sandbox_reports":[{"id":"63f3f1c279c04e39d158f634","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe","analysis_start_time":"2023-02-20T22:18:42+00:00","indicators_count":{"informative":32,"suspicious":13,"malicious":6},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true},{"id":"63ec54be6dd9d8493c614eba","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware.Generic","contacted_countries":["DEU"],"submit_name":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe","analysis_start_time":"2023-02-15T03:42:55+00:00","indicators_count":{"informative":46,"suspicious":25,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"109.206.243.174","port":6696,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]}],"dns_resolutions":[{"domain":"favgrandson7.sytes.net","address":"109.206.243.174","ttl":7,"country":"Germany","registrar_name":"TLDS LLC. d/b/a SRSPlus","registrar_organization":"No-IP.com","registrar_name_servers":"NF1.NO-IP.COM","registrar_creation_date":"1999-04-22T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}],"processes":[{"pid":3276,"ppid":0,"name":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe","command_line":"","sha256":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9","normalized_path":"C:\\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe","uid":"00000000-00003276","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAA3ElEQVR42mNgGCzALmDrf3riAbUcwxGjDhhWDihtb/l/9rYFHNPVAeiWE3IESQ4g5BuYGlyYIgcQG6Q0cUBk1jyig5QmDiDFQFzqyU4D+HxErCPIzgWtU8sJOoCYhEm2A4ixnFJH4HQAKZZT4gisDli/L4gsB+w760odB5BjOQzPWJFGmQMosRyG08onkeeAE9dsqOIAEHYNX0+6A6hlOSmJEu4AaltOrCNo7gCiS0JaOoCouoDWDiBYG9LDAdgcQXcHoDtiQByA7IgBcwDMEQPqABBG6R8OqOUDCQA//PaXteQe3AAAAABJRU5ErkJggg=="},{"pid":1940,"ppid":3276,"name":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe","command_line":"","sha256":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9","normalized_path":"C:\\f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9.exe","parent_uid":"00000000-00003276","uid":"00000000-00001940"},{"pid":4008,"ppid":1940,"name":"schtasks.exe","command_line":"/create /f /tn \"PCI Monitor\" /xml \"%TEMP%\\tmp2666.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00001940","uid":"00000000-00004008"},{"pid":3228,"ppid":1940,"name":"schtasks.exe","command_line":"/create /f /tn \"PCI Monitor Task\" /xml \"%TEMP%\\tmp28E7.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00001940","uid":"00000000-00003228"},{"pid":3224,"ppid":0,"name":"pcimon.exe","command_line":"","sha256":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9","normalized_path":"%PROGRAMFILES%\\PCI Monitor\\pcimon.exe","uid":"00000000-00003224","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAA3ElEQVR42mNgGCzALmDrf3riAbUcwxGjDhhWDihtb/l/9rYFHNPVAeiWE3IESQ4g5BuYGlyYIgcQG6Q0cUBk1jyig5QmDiDFQFzqyU4D+HxErCPIzgWtU8sJOoCYhEm2A4ixnFJH4HQAKZZT4gisDli/L4gsB+w760odB5BjOQzPWJFGmQMosRyG08onkeeAE9dsqOIAEHYNX0+6A6hlOSmJEu4AaltOrCNo7gCiS0JaOoCouoDWDiBYG9LDAdgcQXcHoDtiQByA7IgBcwDMEQPqABBG6R8OqOUDCQA//PaXteQe3AAAAABJRU5ErkJggg=="}],"all_imported_dlls":["sspicli.dll","win32u.dll","imm32.dll","mscoreei.dll","profapi.dll","cryptbase.dll","gdi32.dll","clrjit.dll","WindowsCodecs.dll","wow64cpu.dll","combase.dll","ucrtbase_clr0400.dll","psapi.dll","wldp.dll","amsi.dll","user32.dll","ole32.dll","dwmapi.dll","usp10.dll","gdi32full.dll","shlwapi.dll","uxtheme.dll","oleaut32.dll","cfgmgr32.dll","SHCore.dll","powrprof.dll","comctl32.dll","ws2_32.dll","mscoree.dll","wow64win.dll","System.Core.ni.dll","System.Configuration.ni.dll","windows.storage.dll","winnlsres.dll","crypt32.dll","advapi32.dll","bcryptprimitives.dll","fltLib.dll","shell32.dll","ntdll.dll","msctf.dll","DWrite.dll","msasn1.dll","wintrust.dll","mscorlib.ni.dll","wow64.dll","rpcrt4.dll","kernel.appcore.dll","clr.dll","userenv.dll","KernelBase.dll","msvcp_win.dll","System.Xml.ni.dll","bcrypt.dll","cryptsp.dll","GdiPlus.dll","mscorrc.dll","sechost.dll","ucrtbase.dll","System.ni.dll","kernel32.dll","apphelp.dll","msvcrt.dll","version.dll","vcruntime140_clr0400.dll","rsaenh.dll","riched20.dll","msls31.dll","tzres.dll","lpk.dll","wmiutils.dll","fastprox.dll","wship6.dll","clbcatq.dll","api-ms-win-core-synch-l1-2-0.dll","RpcRtRemote.dll","ntdsapi.dll","System.Windows.Forms.ni.dll","System.Drawing.ni.dll","wbemsvc.dll","nsi.dll","IPHLPAPI.DLL","System.Management.ni.dll","rpcss.dll","System.Windows.Forms.dll","Microsoft.VisualBasic.ni.dll","wbemprox.dll","nlssorting.dll","WMINet_Utils.dll","diasymreader.dll","winnsi.dll","dnsapi.dll","WSHTCPIP.DLL","clrcompression.dll","api-ms-win-core-xstate-l2-1-0.dll","wbemcomn.dll","mswsock.dll","ktmw32.dll","taskschd.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"pcimon.exe","sha256":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"pcimon.exe.bin","sha256":"f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"settings.bin","sha256":"73b0b92179c61c26589b47e9732ce418b07edee3860ee5a2a5fb06f3b8aa9b26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"tmp2666.tmp","sha256":"ca361b5283a01410116e50619fe7fc5ea8d04155223b993a51eb441ab8bd5e25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"tmp28E7.tmp","sha256":"4cd2cf740a16c11cd524cc743caeaf03beca08d37322e82be5f69b23d682bada","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"catalog.dat","sha256":"5347661365e7ad2c1acc27ab0d150ffa097d9246bb3626fca06989e976e8dd29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"run.dat","sha256":"855a8f2fd84c00d1dcb732d6ecd3638c82698639ebecfb9560157e5a6d3ace37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"storage.dat","sha256":"0bd3aac12623520c4e2031c8b96b4a154702f36f97f643158e91e987d317b480","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"task.dat","sha256":"ddfad48a09db7bbc9088dc435cd4fdc72e598b4bd24151f3184cc427f62118c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\settings.bin","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\run.dat","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\task.dat","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\storage.dat","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\catalog.dat","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"},{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3672:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"name":"Local\\SM0:3672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"name":"Local\\SM0:3672:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63f3f1c279c04e39d158f634"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{cb8b3819-b374-4932-8b1b-2c19c1da9851}","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]},{"name":"Global\\{cb8b3819-b374-4932-8b1b-2c19c1da9851}","sources":[{"report_type":"sandbox","report_id":"63ec54be6dd9d8493c614eba"}]}]}},"report_ids":{"sandbox_job_ids":["63f3f1c279c04e39d158f634","63ec54be6dd9d8493c614eba"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample f7205149a172… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f7205149a172…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 11 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample f7205149a172… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f7205149a172…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 11 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f7205149a172adb65e5d473dd42cd653fb6d8e56c2cd412203a5876e4d1090e9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample f7205149a172… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f7205149a172…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 11 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]