24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Matrioska.Generic Sample f797a3482808… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f797a3482808…. Malware family: Matrioska.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2","keywords":["Malicious","Matrioska.Generic","malware analysis","sandbox report","threat intelligence","f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2"],"about":{"@type":"SoftwareApplication","name":"HSBC-Payment_Advice_pdf.scr.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Matrioska.Generic","antivirusDetections":{"malicious":18,"total":25},"behavioralIndicators":{"malicious":11,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta3c,".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004900dcf749002512688938fa490095e1b87795806800feffffffff2bbc779a2abc7764c5a976b69fbc7700000000000000000000000000000000000000000000000001000000000000000000747600000000e0f84900000000000000000000000000f4f84900000000000000000000000000000000002143a9e4e8f84900020000000000000064c5a976a8960a0064c5a97600000000a8960a0020f94900086dbc771881c47718fb4900b69fbc770100000018fb490037ab856d000000000000000000000000000000000000000000000000000074760000000034f94900c89fbc77 (UID: 00000000-00002092) ".exe" called "RtlGetVersion" (UID: 00000000-00002092) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002092) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002092) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000001400000080000000000000000100000020080c0068f02900e8980b000100000014000000020000000c0000001475876d98950b0093950b00000000008cf029000000080028080c01d0ef290098f02900f0f5290095e1b877ad8e6800feffffff435cbc775059bc7794000000a000000092950b0090950b009400000074f12900fdfe60762c080000100000001cf1290020f12900010000001c5cbb772e91bd75ffffffff1a00000000f129000400000000000000ffffffff70f1290039f9856d0000000080f12900006b0c690100000047f9856d0300000000000000a0000000 (UID: 00000000-00002092)26:T740,"ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")27:T84d,"aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")28:T4f1,"aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "aspnet_compiler.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")29:T4ed,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002092) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002092) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002092) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002092) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002092) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002092) ".exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002092) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002092) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002092) ".exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002092) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002092)2a:T617,".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002092) ".exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002092)2b:T68a,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002092.00000001.69823.00080000.00000004.mdmp 00000000-00002092.00000002.71742.00080000.00000004.mdmp 00000000-00002092.00000003.72526.00080000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002092.00000001.69823.00080000.00000004.mdmp 00000000-00002092.00000002.71742.00080000.00000004.mdmp 00000000-00002092.00000003.72526.00080000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002092.00000001.69823.00080000.00000004.mdmp 00000000-00002092.00000001.69823.008F0000.00000002.mdmp 00000000-00002092.00000002.71742.00080000.00000004.mdmp 00000000-00002092.00000002.71742.008F0000.00000002.mdmp 00000000-00002092.00000003.72526.00080000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002092.00000001.69823.00080000.00000004.mdmp 00000000-00002092.00000001.69823.008F0000.00000002.mdmp 00000000-00002092.00000002.71742.00080000.00000004.mdmp 00000000-00002092.00000002.71742.008F0000.00000002.mdmp 00000000-00002092.00000003.72526.00080000.00000004.mdmp2c:Ta730,Found string "AcquireSRWLockExclusive" (Indicator: "AcquireSRWLockExclusive"; in Source: "00000000-00002092-00000C1E-18454213") Found string "AcquireSRWLockShared" (Indicator: "AcquireSRWLockShared"; in Source: "00000000-00002092-00000C1E-24296037") Found string "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; in Source: "00000000-00002092-00000C1E-19359499") Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00002004-00000C1E-34997848") Found string "AdjustTokenPrivilegesW" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00002004-00000C1E-34999357") Found string "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; in Source: "00000000-00002092-00000C1E-19356524") Found string "BCryptCreateHash" (Indicator: "BCryptCreateHash"; in Source: "00000000-00001356-00000C1E-93307350") Found string "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; in Source: "00000000-00001356-00000C1E-93311886") Found string "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; in Source: "00000000-00001356-00000C1E-93332093") Found string "BCryptFinishHash" (Indicator: "BCryptFinishHash"; in Source: "00000000-00001356-00000C1E-93310163") Found string "BCryptGetProperty" (Indicator: "BCryptGetProperty"; in Source: "00000000-00001356-00000C1E-93305862") Found string "BCryptHashData" (Indicator: "BCryptHashData"; in Source: "00000000-00001356-00000C1E-93308784") Found string "BCryptImportKeyPair" (Indicator: "CryptImportKey"; in Source: "00000000-00001356-00000C1E-93325516") Found string "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; in Source: "00000000-00001356-00000C1E-93300933") Found string "CallNextHookEx" (Indicator: "CallNextHookEx"; in Source: "00000000-00001356-00000C1E-91212360") Found string "CertCloseStore" (Indicator: "CertCloseStore"; in Source: "00000000-00001356-00000C1E-92384132") Found string "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; in Source: "00000000-00001356-00000C1E-92392450") Found string "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; in Source: "00000000-00001356-00000C1E-92301732") Found string "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; in Source: "00000000-00001356-00000C1E-92405285") Found string "CertGetCertificateChainW" (Indicator: "CertGetCertificateChain"; in Source: "00000000-00001356-00000C1E-92406603") Found string "CheckTokenMembership" (Indicator: "CheckTokenMembership"; in Source: "00000000-00002092-00000C1E-25624027") Found string "CheckTokenMembershipW" (Indicator: "CheckTokenMembership"; in Source: "00000000-00002004-00000C1E-36946971") Found string "CloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00002092-00000C1E-25997057") Found string "CoCreateFreeThreadedMarshaler" (Indicator: "CoCreateFreeThreadedMarshaler"; in Source: "00000000-00001356-00000C1E-102583218") Found string "CoCreateGuid" (Indicator: "CoCreateGuid"; in Source: "00000000-00002004-00000C1E-36905817") Found string "CoCreateInstance" (Indicator: "CoCreateInstance"; in Source: "00000000-00002092-00000C1E-25391595") Found string "CoGetClassObject" (Indicator: "CoGetClassObject"; in Source: "00000000-00001356-00000C1E-102408001") Found string "CoGetObjectContext" (Indicator: "CoGetObject"; in Source: "00000000-00001356-00000C1E-72064777") Found string "CoInitializeEx" (Indicator: "CoInitialize"; in Source: "00000000-00002092-00000C1E-19952429") Found string "CoMarshalInterface" (Indicator: "CoMarshalInterface"; in Source: "00000000-00001356-00000C1E-103081138") Found string "CompareStringOrdinal" (Indicator: "CompareStringOrdinal"; in Source: "00000000-00002092-00000C1E-20842470") Found string "ConvertSidToStringSidW" (Indicator: "ConvertSidToStringSidW"; in Source: "00000000-00002092-00000C1E-21907250") Found string "CoReleaseMarshalData" (Indicator: "CoReleaseMarshalData"; in Source: "00000000-00001356-00000C1E-77497744") Found string "CorExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00002004-00000C1E-56871175") Found string "CorExitProcess_RetAddr" (Indicator: "ExitProcess"; in Source: "00000000-00002004-00000C1E-56869581") Found string "CoTaskMemAlloc" (Indicator: "CoTaskMemAlloc"; in Source: "00000000-00002092-00000C1E-22604911") Found string "CoTaskMemFree" (Indicator: "CoTaskMemFree"; in Source: "00000000-00002092-00000C1E-22606110") Found string "CoUninitialize" (Indicator: "CoUninitialize"; in Source: "00000000-00002092-00000C1E-48146742") Found string "CreateEventW" (Indicator: "CreateEventW"; in Source: "00000000-00002004-00000C1E-37010096") Found string "CreateFileW" (Indicator: "CreateFileW"; in Source: "00000000-00002004-00000C1E-36910674") Found string "CreateMutexW" (Indicator: "CreateMutexW"; in Source: "00000000-00001356-00000C1E-90813956") Found string "CreateProcessA" (Indicator: "CreateProcessA"; in Source: "00000000-00002092-00000C1E-64212286") Found string "CreateThreadpoolTimer" (Indicator: "CreateThread"; in Source: "00000000-00002092-00000C1E-40045115") Found string "CreateThreadpoolWait" (Indicator: "CreateThread"; in Source: "00000000-00002092-00000C1E-40049342") Found string "CreateThreadpoolWork" (Indicator: "CreateThread"; in Source: "00000000-00002092-00000C1E-40072209") Found string "CreateWaitableTimerExW" (Indicator: "CreateWaitableTimer"; in Source: "00000000-00001356-00000C1E-76333481") Found string "CreateWindowExW" (Indicator: "CreateWindowExW"; in Source: "00000000-00001356-00000C1E-76570388") Found string "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; in Source: "00000000-00002004-00000C1E-35539129") Found string "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; in Source: "00000000-00002092-00000C1E-22443973") Found string "CryptCreateHash" (Indicator: "CryptCreateHash"; in Source: "00000000-00002004-00000C1E-35542079") Found string "CryptDecrypt" (Indicator: "CryptDecrypt"; in Source: "00000000-00002092-00000C1E-22626655") Found string "CryptDestroyHash" (Indicator: "CryptDestroyHash"; in Source: "00000000-00002092-00000C1E-44857795") Found string "CryptDestroyKey" (Indicator: "CryptDestroyKey"; in Source: "00000000-00002092-00000C1E-44858917") Found string "CryptGenKey" (Indicator: "CryptGenKey"; in Source: "00000000-00002004-00000C1E-35551188") Found string "CryptGenRandom" (Indicator: "CryptGenRandom"; in Source: "00000000-00001356-00000C1E-71207065") Found string "CryptGetHashParam" (Indicator: "CryptGetHashParam"; in Source: "00000000-00002092-00000C1E-44856669") Found string "CryptHashData" (Indicator: "CryptHashData"; in Source: "00000000-00002092-00000C1E-44855494") Found string "CryptImportKey" (Indicator: "CryptImportKey"; in Source: "00000000-00002092-00000C1E-22610386") Found string "CryptReleaseContext" (Indicator: "CryptReleaseContext"; in Source: "00000000-00002092-00000C1E-22445148") Found string "CryptSetKeyParam" (Indicator: "CryptSetKeyParam"; in Source: "00000000-00002092-00000C1E-22619405") Found string "DecodePointer" (Indicator: "DecodePointer"; in Source: "00000000-00002092-00000C1E-18248775") Found string "DecryptMessage" (Indicator: "DecryptMessage"; in Source: "00000000-00001356-00000C1E-93636182") Found string "DefWindowProcW" (Indicator: "DefWindowProcW"; in Source: "00000000-00001356-00000C1E-76449098") Found string "DelegateExecute" (Indicator: "DelegateExecute"; in Source: "00000000-00002092-00000BC0-25371486") Found string "DispatchMessageW" (Indicator: "DispatchMessageW"; in Source: "00000000-00001356-00000C1E-77250650") Found string "DuplicateHandle" (Indicator: "DuplicateHandle"; in Source: "00000000-00002092-00000C1E-26000606") Found string "DuplicateTokenEx" (Indicator: "DuplicateToken"; in Source: "00000000-00002004-00000C1E-36941356") Found string "DuplicateTokenExW" (Indicator: "DuplicateToken"; in Source: "00000000-00002004-00000C1E-36942798") Found string "EncodePointer" (Indicator: "EncodePointer"; in Source: "00000000-00002092-00000C1E-21023231") Found string "EncryptMessage" (Indicator: "EncryptMessage"; in Source: "00000000-00001356-00000C1E-93390537") Found string "EnumProcesses" (Indicator: "EnumProcesses"; in Source: "00000000-00001356-00000C1E-91102577") Found string "EnumProcessesW" (Indicator: "EnumProcesses"; in Source: "00000000-00001356-00000C1E-91104460") Found string "EnumProcessModules" (Indicator: "EnumProcessModules"; in Source: "00000000-00002004-00000C1E-35076270") Found string "EnumProcessModulesW" (Indicator: "EnumProcessModules"; in Source: "00000000-00001356-00000C1E-71329570") Found string "EnumWindows" (Indicator: "EnumWindows"; in Source: "00000000-00002004-00000C1E-35205443") Found string "EnumWindowsW" (Indicator: "EnumWindows"; in Source: "00000000-00002004-00000C1E-35207275") Found string "EqualSid" (Indicator: "EqualSid"; in Source: "00000000-00002092-00000C1E-22542265") Found string "EventRegister" (Indicator: "EventRegister"; in Source: "00000000-00002092-00000C1E-18483646") Found string "EventUnregister" (Indicator: "EventUnregister"; in Source: "00000000-00002092-00000C1E-24008439") Found string "EventWrite" (Indicator: "EventWrite"; in Source: "00000000-00002092-00000C1E-24010534") Found string "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStringsW"; in Source: "00000000-00002004-00000C1E-37246759") Found string "FindClose" (Indicator: "FindClose"; in Source: "00000000-00001356-00000C1E-77495448") Found string "FindFirstFileW" (Indicator: "FindFirstFileW"; in Source: "00000000-00001356-00000C1E-77494018") Found string "FlsGetValue" (Indicator: "FlsGetValue"; in Source: "00000000-00002092-00000C1E-18244990") Found string "FlsSetValue" (Indicator: "FlsSetValue"; in Source: "00000000-00002092-00000C1E-18351523") Found string "FormatMessageW" (Indicator: "FormatMessageW"; in Source: "00000000-00001356-00000C1E-126617950") Found string "FreeContextBuffer" (Indicator: "FreeContextBuffer"; in Source: "00000000-00001356-00000C1E-91574340") Found string "FreeCredentialsHandle" (Indicator: "FreeCredentialsHandle"; in Source: "00000000-00001356-00000C1E-91837190") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in Source: "00000000-00001356-00000C1E-84999195") Found string "FreeLibraryW" (Indicator: "FreeLibrary"; in Source: "00000000-00001356-00000C1E-85000590") Found string "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; in Source: "00000000-00002092-00000C1E-40053561") Found string "FreeSid" (Indicator: "FreeSid"; in Source: "00000000-00002092-00000C1E-19359947") Found string "GetACP" (Indicator: "GetACP"; in Source: "00000000-00002004-00000C1E-37337368") Found string "GetAdaptersAddresses" (Indicator: "GetAdaptersAddresses"; in Source: "00000000-00001356-00000C1E-90904290") Found string "GetClientRect" (Indicator: "GetClientRect"; in Source: "00000000-00001356-00000C1E-77230437") Found string "GetComputerName" (Indicator: "GetComputerName"; in Source: "00000000-00002092-00000C1E-49400870") Found string "GetComputerNameW" (Indicator: "GetComputerName"; in Source: "00000000-00002092-00000C1E-49402149") Found string "GetConsoleMode" (Indicator: "GetConsoleMode"; in Source: "00000000-00002004-00000C1E-38550467") Found string "GetConsoleModeW" (Indicator: "GetConsoleMode"; in Source: "00000000-00002004-00000C1E-38551942") Found string "GetConsoleScreenBufferInfo" (Indicator: "GetConsoleScreenBufferInfo"; in Source: "00000000-00002004-00000C1E-36913567") Found string "GetConsoleScreenBufferInfoW" (Indicator: "GetConsoleScreenBufferInfo"; in Source: "00000000-00002004-00000C1E-36915153") Found string "GetConsoleTitleW" (Indicator: "GetConsoleTitleW"; in Source: "00000000-00002004-00000C1E-36985112") Found string "GetCurrentDirectoryW" (Indicator: "etCurrentDirectoryW"; in Source: "00000000-00002004-00000C1E-38096570") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in Source: "00000000-00002092-00000C1E-25999447") Found string "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; in Source: "00000000-00002004-00000C1E-34942693") Found string "GetCurrentProcessIdW" (Indicator: "GetCurrentProcess"; in Source: "00000000-00002004-00000C1E-34944397") Found string "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; in Source: "00000000-00002092-00000C1E-40054606") Found string "GetCurrentProcessW" (Indicator: "GetCurrentProcess"; in Source: "00000000-00002004-00000C1E-36923166") Found string "GetCurrentThread" (Indicator: "GetCurrentThread"; in Source: "00000000-00001356-00000C1E-76580438") Found string "GetCurrentThreadId" (Indicator: "GetCurrentThread"; in Source: "00000000-00001356-00000C1E-76583849") Found string "GetDriveTypeW" (Indicator: "GetDriveTypeW"; in Source: "00000000-00002004-00000C1E-38052741") Found string "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariableW"; in Source: "00000000-00002004-00000C1E-35416657") Found string "GetErrorInfo" (Indicator: "GetErrorInfo"; in Source: "00000000-00001356-00000C1E-72209940") Found string "GetFileAttributesExW" (Indicator: "GetFileAttributesExW"; in Source: "00000000-00002092-00000C1E-20873900") Found string "GetFileInformationByHandleEx" (Indicator: "GetFileInfo"; in Source: "00000000-00002092-00000C1E-40059214") Found string "GetFileSize" (Indicator: "GetFileSize"; in Source: "00000000-00001356-00000C1E-71210914") Found string "GetFileType" (Indicator: "GetFileType"; in Source: "00000000-00002004-00000C1E-37348801") Found string "GetForegroundWindow" (Indicator: "GetForegroundWindow"; in Source: "00000000-00001356-00000C1E-91081391") Found string "GetFullPathNameW" (Indicator: "GetFullPathNameW"; in Source: "00000000-00002092-00000C1E-20870216") Found string "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; in Source: "00000000-00001356-00000C1E-91266442") Found string "GetKeyState" (Indicator: "GetKeyState"; in Source: "00000000-00001356-00000C1E-91200022") Found string "GetLastError" (Indicator: "GetLastError"; in Source: "00000000-00002092-00000C1E-23251422") Found string "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; in Source: "00000000-00002092-00000C1E-20832291") Found string "GetLogicalDrives" (Indicator: "GetLogicalDrives"; in Source: "00000000-00002004-00000C1E-38048644") Found string "GetModuleFileNameExW" (Indicator: "GetModuleFileNameExW"; in Source: "00000000-00002004-00000C1E-35095604") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; in Source: "00000000-00001356-00000C1E-76937959") Found string "GetModuleHandleW" (Indicator: "GetModuleHandleW"; in Source: "00000000-00001356-00000C1E-76441307") Found string "GetNetworkParams" (Indicator: "GetNetworkParams"; in Source: "00000000-00001356-00000C1E-125718160") Found string "GetParent" (Indicator: "GetParent"; in Source: "00000000-00001356-00000C1E-77235541") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in Source: "00000000-00002092-00000C1E-63944752") Found string "GetProcessMemoryInfo" (Indicator: "GetProcessMemoryInfo"; in Source: "00000000-00002092-00000C1E-19556864") Found string "GetStdHandle" (Indicator: "GetStdHandle"; in Source: "00000000-00002004-00000C1E-38547416") Found string "GetStdHandleW" (Indicator: "GetStdHandle"; in Source: "00000000-00002004-00000C1E-38548932") Found string "GetStockObject" (Indicator: "GetStockObject"; in Source: "00000000-00001356-00000C1E-76503879") Found string "GetSystemInfo" (Indicator: "GetSystemInfo"; in Source: "00000000-00002004-00000C1E-37375622") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; in Source: "00000000-00001356-00000C1E-76996070") Found string "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; in Source: "00000000-00001356-00000C1E-84946102") Found string "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; in Source: "00000000-00002092-00000C1E-40061328") Found string "GetSystemWindowsDirectoryW" (Indicator: "GetSystemWindowsDirectoryW"; in Source: "00000000-00002092-00000C1E-19352682") Found string "GetTempPathW" (Indicator: "GetTempPathW"; in Source: "00000000-00001356-00000C1E-85107257") Found string "GetThreadContext" (Indicator: "GetThreadContext"; in Source: "00000000-00002092-00000C1E-64064761") Found string "GetThreadPreferredUILanguages" (Indicator: "GetThreadPreferredUILanguages"; in Source: "00000000-00002004-00000C1E-35390722") Found string "GetThreadPreferredUILanguagesW" (Indicator: "GetThreadPreferredUILanguages"; in Source: "00000000-00002004-00000C1E-35392524") Found string "GetTickCount64" (Indicator: "GetTickCount"; in Source: "00000000-00002092-00000C1E-40058166") Found string "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; in Source: "00000000-00001356-00000C1E-85113513") Found string "GetTokenInformation" (Indicator: "GetTokenInformation"; in Source: "00000000-00002092-00000C1E-19358076") Found string "GetTokenInformationW" (Indicator: "GetTokenInformation"; in Source: "00000000-00002004-00000C1E-36931796") Found string "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; in Source: "00000000-00002092-00000C1E-42858745") Found string "GetUserDefaultLocaleNameW" (Indicator: "GetUserDefaultLocaleName"; in Source: "00000000-00002004-00000C1E-35397723") Found string "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; in Source: "00000000-00002004-00000C1E-34369577") Found string "GetUserName" (Indicator: "GetUserName"; in Source: "00000000-00002092-00000C1E-49415084") Found string "GetUserNameEx" (Indicator: "GetUserName"; in Source: "00000000-00002004-00000C1E-37895264") Found string "GetUserNameExW" (Indicator: "GetUserName"; in Source: "00000000-00002092-00000C1E-25728388") Found string "GetUserNameW" (Indicator: "GetUserName"; in Source: "00000000-00002092-00000C1E-49416306") Found string "GetVersionEx" (Indicator: "GetVersion"; in Source: "00000000-00002004-00000C1E-34666294") Found string "GetVersionExW" (Indicator: "GetVersion"; in Source: "00000000-00002004-00000C1E-34667811") Found string "GetVolumeInformationW" (Indicator: "GetVolumeInformationW"; in Source: "00000000-00002004-00000C1E-38056640") Found string "GetWindow" (Indicator: "GetWindow"; in Source: "00000000-00002004-00000C1E-35373834") Found string "GetWindowLong" (Indicator: "GetWindow"; in Source: "00000000-00001356-00000C1E-76575724") Found string "GetWindowLongW" (Indicator: "GetWindow"; in Source: "00000000-00001356-00000C1E-76577259") Found string "GetWindowRect" (Indicator: "GetWindow"; in Source: "00000000-00001356-00000C1E-77232143") Found string "GetWindowText" (Indicator: "GetWindow"; in Source: "00000000-00001356-00000C1E-91093088") Found string "GetWindowTextA" (Indicator: "GetWindow"; in Source: "00000000-00001356-00000C1E-91094858") Found string "GetWindowTextLength" (Indicator: "GetWindow"; in Source: "00000000-00001356-00000C1E-91086522") Found string "GetWindowTextLengthW" (Indicator: "GetWindow"; in Source: "00000000-00001356-00000C1E-91088257") Found string "GetWindowThreadProcessId" (Indicator: "GetWindow"; in Source: "00000000-00002004-00000C1E-35370384") Found string "GetWindowThreadProcessIdW" (Indicator: "GetWindow"; in Source: "00000000-00002004-00000C1E-35372106") Found string "GlobalFree" (Indicator: "GlobalFree"; in Source: "00000000-00001356-00000C1E-76880122") Found string "GlobalLock" (Indicator: "GlobalLock"; in Source: "00000000-00001356-00000C1E-76878320") Found string "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; in Source: "00000000-00002004-00000C1E-37759534") Found string "GlobalMemoryStatusExW" (Indicator: "GlobalMemoryStatus"; in Source: "00000000-00001356-00000C1E-89616664") Found string "GlobalUnlock" (Indicator: "GlobalUnlock"; in Source: "00000000-00001356-00000C1E-76879343") Found string "IIDFromString" (Indicator: "IIDFromString"; in Source: "00000000-00001356-00000C1E-71742154") Found string "ImmTranslateMessage" (Indicator: "TranslateMessage"; in Source: "00000000-00002092-00000C1E-39797550") Found string "InitializeAcl" (Indicator: "InitializeAcl"; in Source: "00000000-00002092-00000C1E-19359050") Found string "InitializeCriticalSectionAndSpinCount" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00002004-00000C1E-33369006") Found string "InitializeCriticalSectionEx" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00002092-00000C1E-18296788") Found string "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; in Source: "00000000-00002092-00000C1E-25255730") Found string "ioctlsocket" (Indicator: "ioctlsocket"; in Source: "00000000-00001356-00000C1E-90762341") Found string "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; in Source: "00000000-00001724-00000C1E-58754716") Found string "IsProcessorFeaturePresent" (Indicator: "IsProcessorFeaturePresent"; in Source: "00000000-00002004-00000C1E-33434420") Found string "IsWindowUnicode" (Indicator: "IsWindow"; in Source: "00000000-00001356-00000C1E-77245286") Found string "IsWindowVisible" (Indicator: "IsWindow"; in Source: "00000000-00002004-00000C1E-35375474") Found string "IsWindowVisibleW" (Indicator: "IsWindow"; in Source: "00000000-00002004-00000C1E-35377092") Found string "IsWow64Process" (Indicator: "IsWow64Process"; in Source: "00000000-00002004-00000C1E-33825906") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; in Source: "00000000-00002092-00000C1E-63897844") Found string "LoadLibraryExW" (Indicator: "LoadLibraryExW"; in Source: "00000000-00001356-00000C1E-77016336") Found string "LoadStringW" (Indicator: "LoadStringW"; in Source: "00000000-00001356-00000C1E-85033597") Found string "LocalAlloc" (Indicator: "LocalAlloc"; in Source: "00000000-00002092-00000C1E-23253066") Found string "LocalAllocW" (Indicator: "LocalAlloc"; in Source: "00000000-00002004-00000C1E-36935178") Found string "LocaleNameToLCID" (Indicator: "LocaleNameToLCID"; in Source: "00000000-00002092-00000C1E-20834251") Found string "LocalFree" (Indicator: "LocalFree"; in Source: "00000000-00002092-00000C1E-25995509") Found string "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValueW"; in Source: "00000000-00002004-00000C1E-34987684") Found string "lstrlenW" (Indicator: "lstrlenW"; in Source: "00000000-00002004-00000C1E-34855149") Found string "NetApiBufferFree" (Indicator: "NetApiBufferFree"; in Source: "00000000-00002004-00000C1E-57349905") Found string "NetShareEnum" (Indicator: "NetShareEnum"; in Source: "00000000-00002004-00000C1E-31942845") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; in Source: "00000000-00001356-00000C1E-70170320") Found string "NtQuerySystemInformationW" (Indicator: "NtQuerySystemInformation"; in Source: "00000000-00001356-00000C1E-91175677") Found string "OleInitialize" (Indicator: "OleInitialize"; in Source: "00000000-00002092-00000C1E-23940590") Found string "OleUninitialize" (Indicator: "OleUninitialize"; in Source: "00000000-00002092-00000C1E-25974970") Found string "OpenProcess" (Indicator: "OpenProcess"; in Source: "00000000-00002004-00000C1E-35007455") Found string "OpenProcessToken" (Indicator: "OpenProcess"; in Source: "00000000-00002092-00000C1E-19357365") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; in Source: "00000000-00002004-00000C1E-34995578") Found string "OpenProcessW" (Indicator: "OpenProcess"; in Source: "00000000-00002004-00000C1E-35009303") Found string "OpenThreadToken" (Indicator: "OpenThread"; in Source: "00000000-00002092-00000C1E-22284866") Found string "PathRemoveFileSpecW" (Indicator: "PathRemoveFileSpecW"; in Source: "00000000-00002004-00000C1E-32063394") Found string "PeekMessageW" (Indicator: "PeekMessageW"; in Source: "00000000-00001356-00000C1E-77243720") Found string "RaiseException" (Indicator: "RaiseException"; in Source: "00000000-00002092-00000C1E-19431487") Found string "ReadFile" (Indicator: "ReadFile"; in Source: "00000000-00002004-00000C1E-37351103") Found string "ReadProcessMemory" (Indicator: "ReadProcessMemory"; in Source: "00000000-00002092-00000C1E-64284473") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in Source: "00000000-00002092-00000C1E-18256060") Found string "RegCreateKeyExW" (Indicator: "RegCreateKeyExW"; in Source: "00000000-00001356-00000C1E-71846504") Found string "RegEnumKeyExW" (Indicator: "RegEnumKeyExW"; in Source: "00000000-00002092-00000C1E-18252740") Found string "RegEnumValueW" (Indicator: "RegEnumValueW"; in Source: "00000000-00002092-00000C1E-18254843") Found string "RegisterClassW" (Indicator: "RegisterClassW"; in Source: "00000000-00001356-00000C1E-76562573") Found string "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; in File: "f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.bin") Found string "RegOpenKeyExW" (Indicator: "RegOpenKeyExW"; in Source: "00000000-00002092-00000C1E-18508148") Found string "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKeyW"; in Source: "00000000-00002092-00000C1E-18250827") Found string "RegQueryValueExW" (Indicator: "RegQueryValueExW"; in Source: "00000000-00002092-00000C1E-18257816") Found string "ReleaseMutex" (Indicator: "ReleaseMutex"; in Source: "00000000-00002004-00000C1E-38006840") Found string "ReleaseSRWLockExclusive" (Indicator: "ReleaseSRWLockExclusive"; in Source: "00000000-00002092-00000C1E-18455296") Found string "ReleaseSRWLockShared" (Indicator: "ReleaseSRWLockShared"; in Source: "00000000-00002092-00000C1E-24298126") Found string "ResetEvent" (Indicator: "ResetEvent"; in Source: "00000000-00001356-00000C1E-126287130") Found string "ResumeThread" (Indicator: "ResumeThread"; in Source: "00000000-00002092-00000C1E-63946575") Found string "RtlUnwind" (Indicator: "RtlUnwind"; in Source: "00000000-00002004-00000C1E-33819150") Found string "SendMessageA" (Indicator: "SendMessageA"; in Source: "00000000-00001356-00000C1E-76882466") Found string "SetEntriesInAclW" (Indicator: "SetEntriesInAclW"; in Source: "00000000-00002092-00000C1E-25256780") Found string "SetEnvironmentVariableW" (Indicator: "SetEnvironmentVariableW"; in Source: "00000000-00002004-00000C1E-37314366") Found string "SetErrorMode" (Indicator: "SetErrorMode"; in Source: "00000000-00002004-00000C1E-34691317") Found string "SetEvent" (Indicator: "SetEvent"; in Source: "00000000-00002004-00000C1E-38554153") Found string "SetLastError" (Indicator: "SetLastError"; in Source: "00000000-00001356-00000C1E-93382457") Found string "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; in Source: "00000000-00002092-00000C1E-25302336") Found string "SetThreadContext" (Indicator: "SetThreadContext"; in Source: "00000000-00002092-00000C1E-64029879") Found string "SetThreadPreferredUILanguages" (Indicator: "SetThreadPreferredUILanguages"; in Source: "00000000-00002004-00000C1E-35386670") Found string "SetThreadPreferredUILanguagesW" (Indicator: "SetThreadPreferredUILanguages"; in Source: "00000000-00002004-00000C1E-35388485") Found string "SetThreadStackGuarantee" (Indicator: "SetThreadStackGuarantee"; in Source: "00000000-00002004-00000C1E-33871091") Found string "SetWaitableTimerEx" (Indicator: "SetWaitableTimer"; in Source: "00000000-00001356-00000C1E-76335012") Found string "SetWindowsHookExA" (Indicator: "SetWindowsHookExA"; in Source: "00000000-00001356-00000C1E-76939747") Found string "ShellExecuteExW" (Indicator: "ShellExecuteExW"; in Source: "00000000-00002092-00000C1E-23873867") Found string "SHGetFolderPathW" (Indicator: "SHGetFolderPathW"; in Source: "00000000-00002092-00000C1E-25814584") Found string "SleepConditionVariableCS" (Indicator: "Sleep"; in Source: "00000000-00002092-00000C1E-19112677") Found string "SleepConditionVariableSRW" (Indicator: "Sleep"; in Source: "00000000-00002092-00000C1E-40071132") Found string "SLGetWindowsInformationDWORD" (Indicator: "GetWindow"; in Source: "00000000-00002004-00000C1E-32026268") Found string "SortCloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00002092-00000C1E-21857740") Found string "SwitchToThread" (Indicator: "SwitchToThread"; in Source: "00000000-00002004-00000C1E-59918899") Found string "SysAllocStringLen" (Indicator: "SysAllocString"; in Source: "00000000-00001356-00000C1E-90561719") Found string "SysAllocStringLenW" (Indicator: "SysAllocString"; in Source: "00000000-00001356-00000C1E-90563242") Found string "SysFreeString" (Indicator: "SysFreeString"; in Source: "00000000-00001356-00000C1E-90564706") Found string "SysStringLen" (Indicator: "SysStringLen"; in Source: "00000000-00001356-00000C1E-72436216") Found string "ThemeApiConnectionRequest" (Indicator: "ThemeApiConnectionRequest"; in Source: "00000000-00002092-0000003B-6683654") Found string "ToUnicodeEx" (Indicator: "ToUnicodeEx"; in Source: "00000000-00001356-00000C1E-91268811") Found string "TranslateMessage" (Indicator: "TranslateMessage"; in Source: "00000000-00001356-00000C1E-77249082") Found string "TryAcquireSRWLockExclusive" (Indicator: "AcquireSRWLockExclusive"; in Source: "00000000-00002092-00000C1E-40068590") Found string "UnmapViewOfFile" (Indicator: "UnmapViewOfFile"; in Source: "00000000-00002004-00000C1E-37342652") Found string "VaultEnumerateItems" (Indicator: "VaultEnumerateItems"; in Source: "00000000-00001356-00000C1E-77473931") Found string "VaultOpenVault" (Indicator: "VaultOpenVault"; in Source: "00000000-00001356-00000C1E-77467742") Found string "VirtualAllocEx" (Indicator: "VirtualAlloc"; in Source: "00000000-00002092-00000C1E-64100303") Found string "VirtualQuery" (Indicator: "VirtualQuery"; in Source: "00000000-00002004-00000C1E-37378310") Found string "WaitMessage" (Indicator: "WaitMessage"; in Source: "00000000-00001356-00000C1E-108149934") Found string "WakeAllConditionVariable" (Indicator: "WakeAllConditionVariable"; in Source: "00000000-00002092-00000C1E-19113765") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in Source: "00000000-00002092-00000C1E-94825642") Found string "WriteProcessMemory" (Indicator: "WriteProcessMemory"; in Source: "00000000-00002092-00000C1E-64137929") Found string "WSAIoctl" (Indicator: "WSAIoctl"; in Source: "00000000-00001356-00000C1E-126614049") Found string "WSAStartup" (Indicator: "WSAStartup"; in Source: "00000000-00001356-00000C1E-126365142") Found string "ZwUnmapViewOfSection" (Indicator: "ZwUnmapViewOfSection"; in Source: "00000000-00002092-00000C1E-64174778") Found string "TpSetTimer" (Indicator: "SetTimer"; in Source: "00000000-00002092.00000000.67903.0028B000.00000004.mdmp") Found string "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; in Source: "00000000-00002092.00000000.67903.00B82000.00000020.mdmp, 00000000-00002092.00000001.69823.00B82000.00000020.mdmp, 00000000-00002092.00000002.71742.00B82000.00000020.mdmp, 00000000-00002092.00000003.72526.00B82000.00000020.mdmp") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "DuplicateHandle" (Indicator: "DuplicateHandle"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "CloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "CheckRemoteDebuggerPresent" (Indicator: "CheckRemoteDebuggerPresent"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "Sleep" (Indicator: "Sleep"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.02D60000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "SelectObject" (Indicator: "SelectObject"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "DeleteObject" (Indicator: "DeleteObject"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "ResetEvent" (Indicator: "ResetEvent"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "GetLastError" (Indicator: "GetLastError"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "GetCursorForTable" (Indicator: "GetCursor"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "SetEvent" (Indicator: "SetEvent"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "ManualResetEvent" (Indicator: "ResetEvent"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "GetThreadId" (Indicator: "GetThreadId"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "GetCurrentThreadId" (Indicator: "GetCurrentThread"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "IsWindows" (Indicator: "IsWindow"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "GetSystemInfo" (Indicator: "GetSystemInfo"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "SetCursorError" (Indicator: "SetCursor"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "CreateService" (Indicator: "CreateService"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "DeleteService" (Indicator: "DeleteService"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string ",RtlGetNtProductType,NTDLL.d" (Indicator: "RtlGetNtProductType"; in Source: "00000000-00002092.00000001.69823.00080000.00000004.mdmp, 00000000-00002092.00000002.71742.00080000.00000004.mdmp, 00000000-00002092.00000003.72526.00080000.00000004.mdmp") Found string "GetLength" (Indicator: "GetLength"; in Source: "00000000-00002092.00000001.69823.00620000.00000004.mdmp, 00000000-00002092.00000002.71742.00620000.00000004.mdmp, 00000000-00002092.00000003.72526.00620000.00000004.mdmp") Found string "257511685,968,3024,,RtlGetVersion,NTDLL.dll,"252:03:20.906",RX=0,PX=0" (Indicator: "GetVersion"; in Source: "00000000-00002092.00000001.69823.05210000.00000004.mdmp, 00000000-00002092.00000002.71742.05210000.00000004.mdmp") Found string "260046512432,2856,3128,,CreateProcessA,kernel32.dll,"252:04:26.750",RX=0,PX=0" (Indicator: "CreateProcessA"; in Source: "00000000-00002092.00000003.72526.00080000.00000004.mdmp") Found string "GetWindowThreadProcessId" (Indicator: "GetWindow"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "GetProcessId" (Indicator: "GetProcessId"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "VaultFree" (Indicator: "VaultFree"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "MoveFile" (Indicator: "MoveFile"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "GetKeyboardState" (Indicator: "GetKeyboardState"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "GetKeyState" (Indicator: "GetKeyState"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "GetWindowTextLength" (Indicator: "GetWindow"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "VaultGetItem" (Indicator: "VaultGetItem"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "GetVersionInfo" (Indicator: "GetVersion"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "EnumProcessModules" (Indicator: "EnumProcessModules"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "VaultEnumerateItems" (Indicator: "VaultEnumerateItems"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "VaultCloseVault" (Indicator: "VaultCloseVault"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "VaultOpenVault" (Indicator: "VaultOpenVault"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "GetParent" (Indicator: "GetParent"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "BCryptDecrypt" (Indicator: "BCryptDecrypt"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "BCryptEncrypt" (Indicator: "BCryptEncrypt"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "GetWindowText" (Indicator: "GetWindow"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "GetForegroundWindow" (Indicator: "GetForegroundWindow"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "ToUnicodeEx" (Indicator: "ToUnicodeEx"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHookEx"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "CallNextHookEx" (Indicator: "CallNextHookEx"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "BCryptImportKey" (Indicator: "CryptImportKey"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "BCryptGetProperty" (Indicator: "BCryptGetProperty"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp") Found string "BCryptSetProperty" (Indicator: "BCryptSetProperty"; in Source: "00000000-00002092.00000003.72526.02D60000.00000004.mdmp")2d:Ta78,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") ".exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") ".exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") ".exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") ".exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") ".exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") ".exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") ".exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") ".exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") ".exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") ".exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") ".exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") ".exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") ".exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER")2e:T4fb,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "ipconfig.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ipconfig.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ipconfig.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")2f:T4e3,Observed string: "LoadLibrary" (Indicator: "LoadLibrary") in Source: 00000000-00001356-00000C1E-72070733 Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00002092-00000C1E-63897844 Observed string: "LoadLibraryEx" (Indicator: "LoadLibrary") in Source: 00000000-00001356-00000C1E-77014805 Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 00000000-00001356-00000C1E-77016336 Observed string: "LoadLibraryShim" (Indicator: "LoadLibrary") in Source: 00000000-00002004-00000C1E-36765172 Observed string: "LoadLibraryShim_RetAddr" (Indicator: "LoadLibrary") in Source: 00000000-00002004-00000C1E-36763524 Observed string: "LoadLibrary" (Indicator: "LoadLibrary") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp 00000000-00002092.00000001.69823.04300000.00000004.mdmp 00000000-00002092.00000002.71742.04300000.00000004.mdmp 00000000-00002092.00000003.72526.04300000.00000004.mdmp Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp 00000000-00002092.00000001.69823.04300000.00000004.mdmp 00000000-00002092.00000002.71742.04300000.00000004.mdmp 00000000-00002092.00000003.72526.04300000.00000004.mdmp30:T78b,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" ".exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NNNLTOGMORHRVMHJ33X9.temp" "powershell.exe" touched file "C:\Users\OcwIJCm\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"31:T563,".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\system32\amsi.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL"32:T67f,".exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" ".exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\F797A34828089FEB29E7F77D31F184B335D7958755D385FAD50D69FDBD3660D2.EXE.CONFIG" ".exe" trying to access non-existent file "C:\Windows\System32\cmd.exe:Zone.Identifier" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\TIZQIXDRPMP" ".exe" trying to access non-existent file "C:\F797A34828089FEB29E7F77D31F184B335D7958755D385FAD50D69FDBD3660D2.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" ".exe" trying to access non-existent file "C:\F797A34828089FEB29E7F77D31F184B335D7958755D385FAD50D69FDBD3660D2.EXE.LOCAL" ".exe" trying to access non-existent file "C:\Windows\System32\cmd.exe:ZONE.IDENTIFIER" ".exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER"33:Tbaf,Heuristic match: "%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni" Heuristic match: "0123456789+-.eE" Heuristic match: "smtp.yandex.com" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "PMP.re" Pattern match: "Newtonsoft.Json/Newtonsoft.Json.DLL" Pattern match: "onsoft.Json/Newtonsoft.Json" Pattern match: "Newtonsoft.Json/Newtonsoft.Json.EXE" Heuristic match: "Json.NET is a popular high-performance JSON framework for .NET" Pattern match: "https://www.newtonsoft.com/jsonschema" Pattern match: "https://www.nuget.org/packages/Newtonsoft.Json.Bson" Pattern match: "Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E" Pattern match: "crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0" Pattern match: "http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F" Pattern match: "http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=" Pattern match: "http://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0O" Pattern match: "cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0" Pattern match: "https://www.newtonsoft.com/json" Pattern match: "crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0" Pattern match: "http://ocsp.digicert.com0X" Pattern match: "cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertTrustedRootG4.crt0C" Pattern match: "crl3.digicert.com/DigiCertTrustedRootG4.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Heuristic match: "ystem.AppUserModel.ID" Heuristic match: "ystem.IdentityProvider.Name" Heuristic match: "ystem.SAM.Name" Heuristic match: "ystem.StructuredQuery.Is" Heuristic match: "ystem.StructuredQuery.Virtual.Cc" Heuristic match: "ystem.StructuredQuery.Virtual.To" Heuristic match: "System.IdentityProvider.Name" Heuristic match: "System.SAM.Name" Heuristic match: "System.StructuredQuery.Virtual.Cc" Heuristic match: "System.StructuredQuery.Virtual.To" Heuristic match: "System.StructuredQuery.Is" Heuristic match: "System.AppUserModel.ID" Heuristic match: "System.StructuredQueryType.Implicit.Is" Heuristic match: "_SMSvcHostPerfCounters.hU"34:T80f,".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002092) ".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00002092) ".exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00002092)35:T442,Observed string:"EnumProcesses" [Source: 00000000-00001356-00000C1E-91102577] Observed string:"EnumProcessesW" [Source: 00000000-00001356-00000C1E-91104460] Observed string:"EnumProcessModules" [Source: 00000000-00002004-00000C1E-35076270] Observed string:"EnumProcessModulesW" [Source: 00000000-00001356-00000C1E-71329570] Observed string:"GetProcessesByName" [Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp 00000000-00002092.00000001.69823.04300000.00000004.mdmp 00000000-00002092.00000002.71742.04300000.00000004.mdmp 00000000-00002092.00000003.72526.02D60000.00000004.mdmp 00000000-00002092.00000003.72526.04300000.00000004.mdmp] Observed string:"GetProcessById" [Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp 00000000-00002092.00000001.69823.04300000.00000004.mdmp 00000000-00002092.00000002.71742.04300000.00000004.mdmp 00000000-00002092.00000003.72526.02D60000.00000004.mdmp 00000000-00002092.00000003.72526.04300000.00000004.mdmp] Observed string:"EnumProcessModules" [Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]36:T45f,Observed string: "RegEnumKeyEx" (Indicator: "RegEnumKey") in Source: 00000000-00002004-00000C1E-37820929 Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00002092-00000C1E-18252740 Observed string: "RegGetValueW" (Indicator: "RegGetValue") in Source: 00000000-00002092-00000C1E-25338455 Observed string: "RegOpenKeyEx" (Indicator: "RegOpenKey") in Source: 00000000-00002092-00000C1E-21774349 Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00002092-00000C1E-18508148 Observed string: "RegOpenKeyW" (Indicator: "RegOpenKey") in Source: 00000000-00001356-00000C1E-72652323 Observed string: "RegQueryValueEx" (Indicator: "RegQueryValue") in Source: 00000000-00002004-00000C1E-35501036 Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00002092-00000C1E-18257816 Observed string: "RegQueryValueEx" (Indicator: "RegQueryValue") in Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp Observed string: "RegOpenKeyEx" (Indicator: "RegOpenKey") in Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp37:T96d,Observed string: "GetCurrentDirectory" (Indicator: "GetCurrentDirectory") in Source: 00000000-00002004-00000C1E-38095030 Observed string: "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory") in Source: 00000000-00002004-00000C1E-38096570 Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00001356-00000C1E-71210914 Observed string: "GetFileVersionInfo" (Indicator: "GetFileVersionInfo") in Source: 00000000-00002004-00000C1E-34798057 Observed string: "GetFileVersionInfoSize" (Indicator: "GetFileVersionInfo") in Source: 00000000-00002004-00000C1E-34752638 Observed string: "GetFileVersionInfoSize" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00002004-00000C1E-34752638 Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00002092-00000C1E-18700035 Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00002092-00000C1E-18700035 Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00002092-00000C1E-18762165 Observed string: "GetTempPath" (Indicator: "GetTempPath") in Source: 00000000-00001356-00000C1E-85105727 Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: 00000000-00001356-00000C1E-85107257 Observed string: "GetTempPath" (Indicator: "GetTempPath") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp 00000000-00002092.00000001.69823.04300000.00000004.mdmp 00000000-00002092.00000002.71742.04300000.00000004.mdmp 00000000-00002092.00000003.72526.02D60000.00000004.mdmp 00000000-00002092.00000003.72526.04300000.00000004.mdmp Observed string: "GetCurrentDirectory" (Indicator: "GetCurrentDirectory") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp 00000000-00002092.00000001.69823.04300000.00000004.mdmp 00000000-00002092.00000002.71742.04300000.00000004.mdmp 00000000-00002092.00000003.72526.04300000.00000004.mdmp Observed string: "IoErr_GetTempPath" (Indicator: "GetTempPath") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp 00000000-00002092.00000001.69823.04300000.00000004.mdmp 00000000-00002092.00000002.71742.04300000.00000004.mdmp 00000000-00002092.00000003.72526.04300000.00000004.mdmp Observed string: "GetTempFileName" (Indicator: "GetTempFileName") in Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp38:T5bc,"set_AutomaticDecompression" is a hint for the obfuscator "MPRESS" "DecompressionMethods" is a hint for the obfuscator "MPRESS" "Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression" is a hint for the obfuscator "MPRESS" "System.IO.Compression" is a hint for the obfuscator "MPRESS" "CompressionMode" is a hint for the obfuscator "MPRESS" "ystem.Audio.Compression" is a hint for the obfuscator "MPRESS" "ystem.Image.CompressedBitsPerPixel" is a hint for the obfuscator "MPRESS" "ystem.Image.CompressedBitsPerPixelDenominator" is a hint for the obfuscator "MPRESS" "ystem.Image.CompressedBitsPerPixelNumerator" is a hint for the obfuscator "MPRESS" "ystem.Image.Compression" is a hint for the obfuscator "MPRESS" "ystem.Image.CompressionText" is a hint for the obfuscator "MPRESS" "ystem.LzhFolder.CompressedSize" is a hint for the obfuscator "MPRESS" "ystem.Video.Compression" is a hint for the obfuscator "MPRESS" "ystem.ZipFolder.CompressedSize" is a hint for the obfuscator "MPRESS" "System.Image.CompressedBitsPerPixel" is a hint for the obfuscator "MPRESS" "System.Image.CompressedBitsPerPixelNumerator" is a hint for the obfuscator "MPRESS" "System.Image.CompressedBitsPerPixelDenominator" is a hint for the obfuscator "MPRESS" "System.Image.Compression" is a hint for the obfuscator "MPRESS" "System.Image.CompressionText" is a hint for the obfuscator "MPRESS" "System.Audio.Compression" is a hint for the obfuscator "MPRESS"39:T67c,"16.0.0.0" "4.0.0.50" Potential IP "1.0.0.0" found in string "Microsoft.Windows.IsolationAutomation,processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="1.0.0.0"C:\Windows\WinSxS\manifests\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest" Potential IP "1.0.0.0" found in string "MyApplication.app,version="1.0.0.0"C:\f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.exe" "3.0.0.0" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a"" Potential IP "13.0.0.0" found in string "ewtonsoft.Json,13.0.0.0,,30ad4fe6b2a6aeed" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neu" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "=4.0.0.0, Cu" Potential IP "1.0.0.0" found in string "" "1.0.0.0" "1.0.116.0" "4.0.0.0" Potential IP "4.0.0.0" found in string "ternals,4.0.0.0,,31b" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>", "13.0.0.0", Potential IP "5.1.0.0" found in string "Microsoft.Windows.Shell.shell32 processorArchitecture="x86" type="win32" version="5.1.0.0"C:\Windows\system32\SHELL32.dll", Potential IP "5.1.0.0" found in string "Microsoft.Windows.Shell.shell32 processorArchitecture="*" type="win32" version="5.1.0.0"C:\Windows\WindowsShell.Manifest"3a:T102a,Found string "/c ipconfig /release" (Indicator: "ipconfig"; in File: "cmd.exe") Found string "/c ipconfig /renew" (Indicator: "ipconfig"; in File: "cmd.exe") Found string "CheckHostName" (Indicator: "hostname"; in File: "f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.bin") Found string "UriHostNameType" (Indicator: "hostname"; in File: "f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.bin") Found string "CheckHostName" (Indicator: "hostname"; in Source: "00000000-00002092.00000000.67903.00B82000.00000020.mdmp, 00000000-00002092.00000001.69823.00B82000.00000020.mdmp, 00000000-00002092.00000002.71742.00B82000.00000020.mdmp, 00000000-00002092.00000003.72526.00B82000.00000020.mdmp") Found string "UriHostNameType" (Indicator: "hostname"; in Source: "00000000-00002092.00000000.67903.00B82000.00000020.mdmp, 00000000-00002092.00000001.69823.00B82000.00000020.mdmp, 00000000-00002092.00000002.71742.00B82000.00000020.mdmp, 00000000-00002092.00000003.72526.00B82000.00000020.mdmp") Found string "MSTaskListWClass" (Indicator: "tasklist"; in Source: "00000000-00002092.00000000.67903.00DA0000.00000002.mdmp, 00000000-00002092.00000001.69823.00DA0000.00000002.mdmp, 00000000-00002092.00000002.71742.00DA0000.00000002.mdmp") Found string "TaskListOverlayWnd" (Indicator: "tasklist"; in Source: "00000000-00002092.00000000.67903.00DA0000.00000002.mdmp, 00000000-00002092.00000001.69823.00DA0000.00000002.mdmp, 00000000-00002092.00000002.71742.00DA0000.00000002.mdmp") Found string "TaskListThumbnailWnd" (Indicator: "tasklist"; in Source: "00000000-00002092.00000000.67903.00DA0000.00000002.mdmp, 00000000-00002092.00000001.69823.00DA0000.00000002.mdmp, 00000000-00002092.00000002.71742.00DA0000.00000002.mdmp") Found string "FileSystemInfo" (Indicator: "systeminfo"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.02D60000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "SystemInformation" (Indicator: "systeminfo"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.02D60000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "GetSystemInfo" (Indicator: "systeminfo"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "systemInfo" (Indicator: "systeminfo"; in Source: "00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp") Found string "c ipconfig /release" (Indicator: "ipconfig"; in Source: "00000000-00002092.00000001.69823.00080000.00000004.mdmp, 00000000-00002092.00000002.71742.00080000.00000004.mdmp") Found string "icrosoft.IE.TargetUrlHostName" (Indicator: "hostname"; in Source: "00000000-00002092.00000001.69823.00910000.00000002.mdmp, 00000000-00002092.00000002.71742.00910000.00000002.mdmp, 00000000-00002092.00000003.72526.00910000.00000002.mdmp") Found string "ystem.UrlHostName" (Indicator: "hostname"; in Source: "00000000-00002092.00000001.69823.00910000.00000002.mdmp, 00000000-00002092.00000002.71742.00910000.00000002.mdmp, 00000000-00002092.00000003.72526.00910000.00000002.mdmp") Found string "System.UrlHostName" (Indicator: "hostname"; in Source: "00000000-00002092.00000001.69823.01BC0000.00000002.mdmp, 00000000-00002092.00000002.71742.01BC0000.00000002.mdmp, 00000000-00002092.00000003.72526.01BC0000.00000002.mdmp") Found string ":\Windows\System32\cmd.exe" /c ipconfig /renew" (Indicator: "ipconfig"; in Source: "00000000-00002092.00000003.72526.00080000.00000004.mdmp")3b:T552,"aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\POSTBOX\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\CLAWS-MAIL" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES\FOXMAIL\MAIL" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES (X86)\FOXMAIL\MAIL" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA MAIL\OPERA MAIL\WAND.DAT" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\POCOMAIL\ACCOUNTS.INI" "aspnet_compiler.exe" trying to open a file "%APPDATA%\THUNDERBIRD\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "%APPDATA%\POSTBOX\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "%APPDATA%\CLAWS-MAIL" "aspnet_compiler.exe" trying to open a file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES\FOXMAIL\MAIL" "aspnet_compiler.exe" trying to open a file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES (X86)\FOXMAIL\MAIL" "aspnet_compiler.exe" trying to open a file "%APPDATA%\OPERA MAIL\OPERA MAIL\WAND.DAT" "aspnet_compiler.exe" trying to open a file "%APPDATA%\POCOMAIL\ACCOUNTS.INI"3c:T526,".exe" wrote bytes "db4d8a6d00000000" to virtual address "0x00D64DC8" (part of module "F797A34828089FEB29E7F77D31F184B335D7958755D385FAD50D69FDBD3660D2.EXE") ".exe" wrote bytes "550c47d0" to virtual address "0x68F7F798" (part of module "CLR.DLL") "powershell.exe" wrote bytes "9d42b3da" to virtual address "0x64C91FFC" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "d055fa76647303770000000051c1517694985176ee9c517675dc5376273e53760fb3577600000000acdc60761bf76076c1086276c0d96076152e607636da6076d5d9607630c66076e0c2607642c660761bc6607686c4607672c6607600000000" to virtual address "0x6D571000" (part of module "SHFOLDER.DLL") "aspnet_compiler.exe" wrote bytes "db4d8a6d00000000" to virtual address "0x00402000" "aspnet_compiler.exe" wrote bytes "e739b877e1a6bc772e71bc77ee29bc7785e2b7776da0bc779064bb773ad5c27726e4b777d16dbc77003dba77804bba7700000000ad37d1778b2dd177b641d17700000000" to virtual address "0x75431000" (part of module "WSHIP6.DLL") "aspnet_compiler.exe" wrote bytes "fae6b777e1a6bc772e71bc77ee29bc7785e2b7776da0bc7726e4b777d16dbc77003dba77804bba7700000000ad37d1778b2dd177b641d17700000000" to virtual address "0x74EE1000" (part of module "WSHTCPIP.DLL") "aspnet_compiler.exe" wrote bytes "cd1d4e4d" to virtual address "0x68F7F798" (part of module "CLR.DLL")3d:T5ea,".exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 976) ".exe" wrote 32 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 488) ".exe" wrote 52 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 488) ".exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 488) ".exe" wrote 512 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 488) ".exe" wrote 165376 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 488) ".exe" wrote 1536 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 488) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 976) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 976) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\ipconfig.exe" (Handle: 136) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\ipconfig.exe" (Handle: 136) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\ipconfig.exe" (Handle: 136)3e:T688,"aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") "aspnet_compiler.exe" (Path: "HKCU\SOFTWARE\INCREDIMAIL\IDENTITIES")3f:T10b4,"aspnet_compiler.exe" trying to open a file "C:\Users\OcwIJCm\AppData\Local\UCBrowser\" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\EDGE\USER DATA" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\LOGINS.JSON" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.SQLITE" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\NETGATE TECHNOLOGIES\BLACKHAWK\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\8PECXSTUDIOS\CYBERFOX\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\K-MELEON\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\ICECAT\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\MOONCHILD PRODUCTIONS\PALE MOON\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\COMODO\ICEDRAGON\PROFILES.INI" "aspnet_compiler.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\WATERFOX\PROFILES.INI"40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAARERERERERERETMwAAAAABEREREREREREzMzMQAAAAARERERERERETMzMzEAAAAAERERERERETMzMzMxAAAAABERERMRERMzMzMzMQAAAAARERcXEREzMzMzMzEAAAAAERERdzETMzMzMzMxAAAAABERERdxMzMzMzMzMQAAAAARERERd3MzMzMzMzEAAAAAEREREXd3MzMzMzMxAAAAABERERM3M3c5mTMzMQAAAAAREREzNzM3d5l3czEAAAAAERERMzc5mZd3d3cxAAAAABEREzM3OZmXh3d3MQAAAAARETMzN3mZeHmTMzEAAAAAERMzM5d5l4eZmTMxAAAAABETMzmZiZh5mZMzMQAAAAARMzOZmYmHmZmTMzEAAAAAEzMzmZmIiZmZkzMxAAAAABMzOZmZiJmZmZMzMQAAAAATM5mZmYeZmZkzMzEAAAAAEzmZmZiJmZmZMzMRAAAAABM5mZl4iZmZmTMzEQAAAAATmZmZiImZmZMzMxEAAAAAE5mZmYmJmZmTMzERAAAAABmZmZeHiZmZkzMxEQAAAAAZmZmYiHmZmTMzEREAAAAAGZmZmYiZmZkzMRERAAAAABmZmZmZmZmTMxN3EQAAAAAZmZmZmZmZkzN3MQAAAAAAGZmZmZmZmTN3MAAAAADwAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAA/8AAB/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790566598198,"unified_at":"2026-09-28T03:36:38.198Z","metadata":{"hashes":{"sha256":"f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2","sha1":"9c804dc2a5b381ab9ccc69073434fbcd03e6398e","md5":"b3469fface251fb3d6a9e2da0d236802","sha512":"431250e398eafcf193245d37f5eaf87ebb37e3cda0f5915e77f504e65e46606d95212ad7fb934a28e98b27a7de333aaf438c8d38849f343592050f3fabe3d463","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"HSBC-Payment_Advice_pdf.scr.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":2171392,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1678894527000,"last_seen":1704866594000,"last_multi_scan":1704866594000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":60},"sandbox_signatures":{"informative_count":127,"suspicious_count":21,"malicious_count":11,"total":159},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.GenKryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Redcap.zfait","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Matrioska.6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packer.DotNetRev-10003973-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Matrioska.6 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AIIV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/MSIL.Obfuscator.yp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005a0f3a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.MSIL.Seraph.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXVP-TF!B3469FFACE25","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Seraph.jvhwca","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Faker.AO.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.PSWStealer.DPO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.Seraph.Win32.2967","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Matrioska.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains reference to Windows native API (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function address"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Found Windows API related strings"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Persistence","technique":"PowerShell Profile","attack_id":"T1546.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/013","identifiers":[{"type":"informative","value":"Creates/Opens a file related to powershell profile"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to write data into process memory (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify the virtual address space of a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"},{"type":"informative","value":"Contains ability to create/open registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"suspicious","value":"Uses powershell with an encoded commandline"},{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"Loads the cryptographic module DLL"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Possibly use system binaries"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data (API string)"},{"type":"informative","value":"Found decryption/decode related string"},{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"},{"type":"informative","value":"Contains ability to decrypt message (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Contains ability to retrieve system configuration"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Reads configuration files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains ability to read registry keys (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to gather system network configuration using IPCONFIG"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve local/system time as file time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the name of the user associated with the current thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve local network connections"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Checks on FTP client related files"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"suspicious","value":"Tries to access mail clients information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"malicious","value":"Sends network traffic on a typical mail related ports"},{"type":"suspicious","value":"Contacts Mail Related Domain Names"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to copy files"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00001356-00000C1E-84999195\n Observed string: \"FreeLibraryW\" (Indicator: \"FreeLibrary\") in Source: 00000000-00001356-00000C1E-85000590\n Observed string: \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\") in Source: 00000000-00002092-00000C1E-40053561","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00002092-00000C1E-19357365\n Observed string: \"OpenProcessTokenW\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00002004-00000C1E-34995578","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify the virtual address space of a process (API string)","description":"Observed string: \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\") in Source: 00000000-00002092-00000C1E-64100303\n Observed string: \"VirtualAlloc\" (Indicator: \"VirtualAlloc\") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Observed string: \"CallWindowProc\" (Indicator: \"CallWindowProc\") in Source: 00000000-00001356-00000C1E-76658768\n Observed string: \"CallWindowProcW\" (Indicator: \"CallWindowProc\") in Source: 00000000-00001356-00000C1E-76660321","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write data into process memory (API string)","description":"Observed string:\"WriteProcessMemory\" [Source: 00000000-00002092-00000C1E-64137929]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Observed string:\"IsDebuggerPresent\" [Source: 00000000-00001724-00000C1E-58754716]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed string:\"frombase64string\" [Source: f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.bin]\n Observed string:\"frombase64string\" [Source: 00000000-00002092.00000000.67903.00B82000.00000020.mdmp\n 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.00620000.00000004.mdmp\n 00000000-00002092.00000001.69823.00B82000.00000020.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.00620000.00000004.mdmp\n 00000000-00002092.00000002.71742.00B82000.00000020.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.00620000.00000004.mdmp\n 00000000-00002092.00000003.72526.00B82000.00000020.mdmp\n 00000000-00002092.00000003.72526.02D60000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decrypt message (API string)","description":"Observed string: \"DecryptMessage\" (Indicator: \"DecryptMessage\") in Source: 00000000-00001356-00000C1E-93636182","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Observed string: \"EncryptMessage\" (Indicator: \"EncryptMessage\") in Source: 00000000-00001356-00000C1E-93390537","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Observed string:\"description=\"Uses CryptProtectData and Crypt\" which can performs encryption on the data. [Source: 00000000-00002092.00000000.67903.00080000.00000004.mdmp], Observed string:\"description=\"Uses CryptProtectData and CryptUnProtectData Windows AKS\" which can performs encryption on the data. [Source: 00000000-00002092.00000000.67903.00080000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Observed string: \"ad certificate public key\" (Indicator: \"public key\") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Cryptographic Related","name":"Found decryption/decode related string","description":"Observed string:\"createdecryptor\" [Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.02D60000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00002092)\n \"aspnet_compiler.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001356)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\".exe\" called \"IsWow64Process\" with parameter \"2092\" - (UID: 00000000-00002092)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2004\" - (UID: 00000000-00002004)\n \"powershell.exe\" called \"IsWow64Process\" (UID: 00000000-00002004)\n \"cmd.exe\" called \"IsWow64Process\" with parameter \"1724\" - (UID: 00000000-00001724)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002004)","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"aspnet_compiler.exe\" called \"GetWindowTextA\" with parameter \"Program Manager\" - (UID: 00000000-00001356)\n \"aspnet_compiler.exe\" called \"GetWindowTextA\" with parameter \"Task Switching\" - (UID: 00000000-00001356)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002092)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002092)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00002004)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\"aspnet_compiler.exe\" called \"LookupAccountSidW\" (UID: 00000000-00001356)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002092)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00002004)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002004)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00001356-00000C1E-84946102\n Observed string: \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00002092-00000C1E-40061328","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Observed string:\"EnumSystemLocalesEx\" [Source: 00000000-00001356-00000C1E-85123094]\n Observed string:\"GetLocaleInfoEx\" [Source: 00000000-00002092-00000C1E-20832291]\n Observed string:\"GetUserDefaultLCID\" [Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Observed string:\"GlobalMemoryStatusEx\" [Source: 00000000-00002004-00000C1E-37759534]\n Observed string:\"GlobalMemoryStatusExW\" [Source: 00000000-00001356-00000C1E-89616664]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"ipconfig.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"aspnet_compiler.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local/system time as file time (API string)","description":"Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\") in Source: 00000000-00001356-00000C1E-84946102","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00001356-00000C1E-84946102\n Observed string: \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00002092-00000C1E-40061328","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Observed string: \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\") in Source: 00000000-00001356-00000C1E-84948293\n Observed string: \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\") in Source: 00000000-00001356-00000C1E-85113513","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Observed string: \"GetNetworkParams\" (Indicator: \"GetNetworkParams\") in Source: 00000000-00001356-00000C1E-125718160","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"EnumWindows\"[Source: 00000000-00002004-00000C1E-35205443]\n Observed api:\"EnumWindows\"[Source: 00000000-00002004-00000C1E-35207275]\n Observed api:\"GetForegroundWindow\"[Source: 00000000-00001356-00000C1E-91081391]\n Observed api:\"GetWindowText\"[Source: 00000000-00001356-00000C1E-91093088]\n Observed api:\"GetWindowText\"[Source: 00000000-00001356-00000C1E-91094858]\n Observed api:\"GetWindowText\"[Source: 00000000-00001356-00000C1E-91086522]\n Observed api:\"GetWindowText\"[Source: 00000000-00001356-00000C1E-91088257]\n Observed api:\"GetWindowText\"[Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]\n Observed api:\"GetForegroundWindow\"[Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system configuration","description":"Observed string: \"systemInfo\" (Indicator: \"systeminfo\") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-359","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Observed api: \"GetUserDefaultUILanguage\"[Source: 00000000-00002004-00000C1E-34369577]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed string:\"GetVersionEx \" [Source: 00000000-00002004-00000C1E-34666294]\n Observed string:\"GetVersionExW \" [Source: 00000000-00002004-00000C1E-34667811]\n Observed string:\"GetVersionInfo \" [Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Observed string:\"GetVolumeInformation\" [Source: 00000000-00002004-00000C1E-38055097]\n Observed string:\"GetVolumeInformation\" [Source: 00000000-00002004-00000C1E-38056640]\n Observed string:\"GetVolumeInformation\" [Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.exe\" at 00000000-00002092-0000010C-12899821011315013\n \".exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002092-0000010C-12899821012650391\n \".exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll\" at 00000000-00002092-0000010C-12899821013014866\n \"aspnet_compiler.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" at 00000000-00001356-0000010C-4983090","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ipconfig.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"aspnet_compiler.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"aspnet_compiler.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\D93F411851D7C929.CUSTOMDESTINATIONS-MS\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\NNNLTOGMORHRVMHJ33X9.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\NNNLTOGMORHRVMHJ33X9.temp\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\OcwIJCm\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002092)\n \".exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00002092)\n \".exe\" called \"CreateDirectoryW\" (UID: 00000000-00002092)\n \"powershell.exe\" called \"CreateDirectoryW\" (UID: 00000000-00002004)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations (UID: 00000000-00002004)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00002004)\n \"aspnet_compiler.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00001356)\n \"aspnet_compiler.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00001356)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c ipconfig /release\" - (UID: 00000000-00002092)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANAA1AA==\" - (UID: 00000000-00002092)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c ipconfig /renew\" - (UID: 00000000-00002092)\n \".exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" - (UID: 00000000-00002092)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"ipconfig /release\" - (UID: 00000000-00003756)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"ipconfig /renew\" - (UID: 00000000-00001724)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function address","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"77.88.21.158:587\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Users\\Administrator\\Desktop\\PureProducts\\Builds\\9495-4cc3-54fa-1f74-9673-d9e3-50b3\\WindowsFormsApp1\\bin\\Release\\TizqixdrPMP.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00002092-00000C1E-18256060\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Observed string: \"CreateProcessA\" (Indicator: \"CreateProcess\") in Source: 00000000-00002092-00000C1E-64212286\n Observed string: \"CreateProcessingInstruction\" (Indicator: \"CreateProcess\") in Source: 00000000-00002092.00000001.69823.00620000.00000004.mdmp\n 00000000-00002092.00000002.71742.00620000.00000004.mdmp\n 00000000-00002092.00000003.72526.00620000.00000004.mdmp\n Observed string: \"260046512432,2856,3128,,CreateProcessA,kernel32.dll,\"252:04:26.750\",RX=0,PX=0\" (Indicator: \"CreateProcess\") in Source: 00000000-00002092.00000003.72526.00080000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Observed string: \"CreateFile\" (Indicator: \"CreateFile\") in Source: f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.bin\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00002004-00000C1E-36910674\n Observed string: \"CreateFile\" (Indicator: \"CreateFile\") in Source: 00000000-00002092.00000000.67903.00B82000.00000020.mdmp\n 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.00B82000.00000020.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.00B82000.00000020.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.00B82000.00000020.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00001356-00000C1E-71846504","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Observed string: \"ShellExecuteEx\" (Indicator: \"ShellExecute\") in Source: 00000000-00002092-00000C1E-23872815\n Observed string: \"ShellExecuteExW\" (Indicator: \"ShellExecute\") in Source: 00000000-00002092-00000C1E-23873867\n Observed string: \"set_UseShellExecute\" (Indicator: \"ShellExecute\") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.02D60000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"Observed API string: \"CreateThread\" [Source: 00000000-00002092-00000C1E-40045115]\n Observed API string: \"CreateThread\" [Source: 00000000-00002092-00000C1E-40049342]\n Observed API string: \"CreateThread\" [Source: 00000000-00002092-00000C1E-40072209]\n Observed API string: \"GetThreadContext\" [Source: 00000000-00002092-00000C1E-64064761]\n Observed API string: \"OpenThread\" [Source: 00000000-00002092-00000C1E-22284866]\n Observed API string: \"ResumeThread\" [Source: 00000000-00002092-00000C1E-63946575]\n Observed API string: \"SetThreadContext\" [Source: 00000000-00002092-00000C1E-64029879]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Observed string: \"MoveFile\" (Indicator: \"MoveFile\") in Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Observed string: \"OpenProcess\" (Indicator: \"OpenProcess\") in Source: 00000000-00002004-00000C1E-35007455\n Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcess\") in Source: 00000000-00002092-00000C1E-19357365\n Observed string: \"OpenProcessTokenW\" (Indicator: \"OpenProcess\") in Source: 00000000-00002004-00000C1E-34995578\n Observed string: \"OpenProcessW\" (Indicator: \"OpenProcess\") in Source: 00000000-00002004-00000C1E-35009303","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 00000000-00002092-00000C1E-23251422\n Observed string: \"SetLastError\" (Indicator: \"SetLastError\") in Source: 00000000-00001356-00000C1E-93382457\n Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Observed string: \"StartService\" (Indicator: \"StartService\") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Contains reference to Windows native API (API string)","description":"Observed string:\"CloseHandle\" that closes an open object handle. [Source: 00000000-00002092-00000C1E-25997057]\n Observed string:\"CreateFile\" that creates/opens a file or I/O device. [Source: f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.bin]\n Observed string:\"CreateFileW\" that creates/opens a file or I/O device. [Source: 00000000-00002004-00000C1E-36910674]\n Observed string:\"ReadFile\" that reads data from a file or I/O device. [Source: 00000000-00002004-00000C1E-37351103]\n Observed string:\"SortCloseHandle\" that closes an open object handle. [Source: 00000000-00002092-00000C1E-21857740]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"_SHuassist.mtx\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 72450000\n \".exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \".exe\" loaded module \"KERNEL32\" at base 765c0000\n \".exe\" loaded module \"ADVAPI32.DLL\" at base 76d10000\n \".exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSCOREEI.DLL\" at base 6d770000\n \".exe\" loaded module \"SHLWAPI.DLL\" at base 76c30000\n \".exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL\" at base 0\n \".exe\" loaded module \"VERSION.DLL\" at base 74ff0000\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67B60000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 640F0000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 66750000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 687C0000\n \".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68F70000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68F70000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75F70000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75F70000\n \"ipconfig.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75F70000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75F70000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75F70000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\"aspnet_compiler.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75150000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e00fe028e6d@ADVAPI32.dll\"\n \"0b000c00cc028e6d@ADVAPI32.dll\"\n \"10001100da028e6d@ADVAPI32.dll\"\n \"150016002c7a886d@ADVAPI32.dll\"\n \"0e000f00a47a886d@ADVAPI32.dll\"\n \"0e000f00d87a886d@ADVAPI32.dll\"\n \"11001200387f886d@ADVAPI32.dll\"\n \"11001200a47f886d@ADVAPI32.dll\"\n \"12001300b87f886d@ADVAPI32.dll\"\n \"12001300e07f886d@ADVAPI32.dll\"\n \"140015009493886d@ADVAPI32.dll\"\n \"1b001c00381f776d@api-ms-win-core-synch-l1-2-0.DLL\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /c ipconfig /release\" [Source: 00000000-00002092-00000C39-11184]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /c ipconfig /renew\" [Source: 00000000-00002092-00000C39-258272615840]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANAA1AA==\" [Source: 00000000-00002092-00000C39-257511696]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00002092-00000C39-11184]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00002092-00000C39-257511696]","origin":"File/Memory","mitre_attack_id":"T1036","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"ipconfig.exe\" (UID: 00000000-00003464) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"powershell.exe\" (UID: 00000000-00002004) was launched with modified environment variables: \"Path\"\n Process \"powershell.exe\" (UID: 00000000-00002004) was launched with missing environment variables: \"PROMPT\"\n Process \"cmd.exe\" (UID: 00000000-00001724) was launched with modified environment variables: \"Path\"\n Process \"ipconfig.exe\" (UID: 00000000-00001428) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"aspnet_compiler.exe\" (UID: 00000000-00001356) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"smtp.yandex.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c ipconfig /release\" on 2023-3-24.18:33:14.031\n \"/c ipconfig /renew\" on 2023-3-24.18:36:13.687","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c ipconfig /release\" (UID: 00000000-00003756)\n Spawned process \"ipconfig.exe\" with commandline \"ipconfig /release\" (UID: 00000000-00003464)\n Spawned process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANAA ...\" (UID: 00000000-00002004)\n Spawned process \"cmd.exe\" with commandline \"/c ipconfig /renew\" (UID: 00000000-00001724)\n Spawned process \"ipconfig.exe\" with commandline \"ipconfig /renew\" (UID: 00000000-00001428)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00001356)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c ipconfig /release\" (UID: 00000000-00003756)\n Spawned process \"ipconfig.exe\" with commandline \"ipconfig /release\" (UID: 00000000-00003464)\n Spawned process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANAA ...\" (UID: 00000000-00002004)\n Spawned process \"cmd.exe\" with commandline \"/c ipconfig /renew\" (UID: 00000000-00001724)\n Spawned process \"ipconfig.exe\" with commandline \"ipconfig /renew\" (UID: 00000000-00001428)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00001356)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"aspnet_compiler.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"\"CreateService\" (Indicator: \"CreateService\"; File: \"00000000-00002092.00000000.67903.04300000.00000004.mdmp, 00000000-00002092.00000001.69823.04300000.00000004.mdmp, 00000000-00002092.00000002.71742.04300000.00000004.mdmp, 00000000-00002092.00000003.72526.04300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/Opens a file related to powershell profile","description":"\"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to touch file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to touch file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to touch file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to touch file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1546.013","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"NNNLTOGMORHRVMHJ33X9.temp\" has type \"data\"- Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\NNNLTOGMORHRVMHJ33X9.temp]- [targetUID: 00000000-00002004]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Observed string: \"WSAStartup\" (Indicator: \"WSAStartup\") in Source: 00000000-00001356-00000C1E-126365142","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Observed string:\"NetShareEnum\" [Source: 00000000-00002004-00000C1E-31942845]","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"Observed string: \"ipconfig\" (Indicator: \"ipconfig\") in Source: 00000000-00003464-00000BC0-48661954","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-325","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve local network connections","description":"Observed string: \":\\Users\\OcwIJCm\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\" (Indicator: \"net file\") in Source: 00000000-00002092.00000001.69823.00080000.00000004.mdmp\n 00000000-00002092.00000002.71742.00080000.00000004.mdmp\n 00000000-00002092.00000003.72526.00080000.00000004.mdmp\n Observed string: \"porary Internet Files\" (Indicator: \"net file\") in Source: 00000000-00002092.00000001.69823.00080000.00000004.mdmp\n 00000000-00002092.00000002.71742.00080000.00000004.mdmp\n Observed string: \"icrosoft\\Windows\\Temporary Internet Files\" (Indicator: \"net file\") in Source: 00000000-00002092.00000001.69823.00080000.00000004.mdmp\n 00000000-00002092.00000002.71742.00080000.00000004.mdmp\n 00000000-00002092.00000003.72526.00080000.00000004.mdmp\n Observed string: \"temporary asp.net files\" (Indicator: \"net file\") in Source: 00000000-00002092.00000003.72526.05210000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-361","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"smtp.yandex.com\" [Source: PCAP]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$33","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"uJSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details.\" (Indicator: \"https://\")\n \"BSON reading and writing has been moved to its own package. See https://www.nuget.org/packages/Newtonsoft.Json.Bson for more details.\" (Indicator: \"https://\")\n \"https://www.newtonsoft.com/json 0\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00002092\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002092)\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002004)\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001724)\n \"aspnet_compiler.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001356)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed string:\"GetDriveType\" [Source: 00000000-00002004-00000C1E-38050828]\n Observed string:\"GetDriveTypeW\" [Source: 00000000-00002004-00000C1E-38052741]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string:\"FindFirstFileW\" [Source: 00000000-00001356-00000C1E-77494018]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Observed string: \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\") in Source: 00000000-00001356-00000C1E-90904290","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Observed string:\"GetLogicalDrives\" [Source: 00000000-00002004-00000C1E-38048644]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00002092-00000C1E-63944752\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Observed string:\",RtlGetNtProductType,NTDLL.d\" [Source: 00000000-00002092.00000001.69823.00080000.00000004.mdmp\n 00000000-00002092.00000002.71742.00080000.00000004.mdmp\n 00000000-00002092.00000003.72526.00080000.00000004.mdmp]\n Observed string:\"257511685,968,3024,,RtlGetVersion,NTDLL.dll,\"252:03:20.906\",RX=0,PX=0\" [Source: 00000000-00002092.00000001.69823.05210000.00000004.mdmp\n 00000000-00002092.00000002.71742.05210000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed string:\"GetKeyState\" [Source: 00000000-00001356-00000C1E-91200022]\n Observed string:\"GetKeyboardState\" [Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]\n Observed string:\"GetKeyState\" [Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]\n Observed string:\"MapVirtualKey\" [Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string:\"ExpandEnvironmentStrings\" [Source: 00000000-00002004-00000C1E-37244952]\n Observed string:\"ExpandEnvironmentStringsW\" [Source: 00000000-00002004-00000C1E-37246759]\n Observed string:\"GetSystemInfo\" [Source: 00000000-00002004-00000C1E-37375622]\n Observed string:\"NtQuerySystemInformation\" [Source: 00000000-00001356-00000C1E-70170320]\n Observed string:\"NtQuerySystemInformationW\" [Source: 00000000-00001356-00000C1E-91175677]\n Observed string:\"GetSystemInfo\" [Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed string:\"GetComputerNameW\" [Source: 00000000-00002092-00000C1E-49402149]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string:\"GetModuleFileName\" [Source: 00000000-00002004-00000C1E-35093733]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00002004-00000C1E-35095604]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed string:\"GetEnvironmentVariable\" [Source: 00000000-00002004-00000C1E-35415135]\n Observed string:\"GetEnvironmentVariableW\" [Source: 00000000-00002004-00000C1E-35416657]\n Observed string:\"GetEnvironmentVariable\" [Source: 00000000-00002092.00000000.67903.04300000.00000004.mdmp\n 00000000-00002092.00000001.69823.04300000.00000004.mdmp\n 00000000-00002092.00000002.71742.04300000.00000004.mdmp\n 00000000-00002092.00000003.72526.02D60000.00000004.mdmp\n 00000000-00002092.00000003.72526.04300000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the name of the user associated with the current thread (API string)","description":"Observed string:\"GetUserName\" [Source: 00000000-00002092-00000C1E-49415084]\n Observed string:\"GetUserNameEx\" [Source: 00000000-00002004-00000C1E-37895264]\n Observed string:\"GetUserNameExW\" [Source: 00000000-00002092-00000C1E-25728388]\n Observed string:\"GetUserNameW\" [Source: 00000000-00002092-00000C1E-49416306]","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed string:\"GetSystemMetrics\" [Source: 00000000-00001356-00000C1E-76996070]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00002092-00000C1E-40058166","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Observed string:\"DllGetClassObjectInternal\" [Source: 00000000-00002004-00000C1E-33679334]","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\NNNLTOGMORHRVMHJ33X9.temp\" with delete access\n \"powershell.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\SECURITY.CONFIG.CCH.2004.907407078\" with delete access\n \"powershell.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\ENTERPRISESEC.CONFIG.CCH.2004.907407093\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\CLR SECURITY CONFIG\\V2.0.50727.312\\SECURITY.CONFIG.CCH.2004.907407140\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Observed string: \"CoGetObjectContext\" (Indicator: \"CoGetObject\") in Source: 00000000-00001356-00000C1E-72064777","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Observed string:\"CallNextHookEx\" [Source: 00000000-00001356-00000C1E-91212360]\n Observed string:\"SetWindowsHookEx\" [Source: 00000000-00001356-00000C1E-76939164]\n Observed string:\"SetWindowsHookExA\" [Source: 00000000-00001356-00000C1E-76939747]\n Observed string:\"UnhookWindowsHookEx\" [Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]\n Observed string:\"SetWindowsHookEx\" [Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]\n Observed string:\"CallNextHookEx\" [Source: 00000000-00002092.00000003.72526.02D60000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1056.004","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Observed string:\"AdjustTokenPrivileges\" [Source: 00000000-00002004-00000C1E-34997848]\n Observed string:\"AdjustTokenPrivilegesW\" [Source: 00000000-00002004-00000C1E-34999357]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Observed string: \"CorExitProcess\" (Indicator: \"ExitProcess\") in Source: 00000000-00002004-00000C1E-56871175\n Observed string: \"CorExitProcess_RetAddr\" (Indicator: \"ExitProcess\") in Source: 00000000-00002004-00000C1E-56869581","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"aspnet_compiler.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"aspnet_compiler.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Observed string: \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\") in Source: 00000000-00002004-00000C1E-57349905","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Observed string: \"CreateMutex\" (Indicator: \"CreateMutex\") in Source: 00000000-00001356-00000C1E-90812388\n Observed string: \"CreateMutexW\" (Indicator: \"CreateMutex\") in Source: 00000000-00001356-00000C1E-90813956\n Observed string: \"ReleaseMutex\" (Indicator: \"ReleaseMutex\") in Source: 00000000-00002004-00000C1E-38006840","origin":"File/Memory","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"NNNLTOGMORHRVMHJ33X9.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\NNNLTOGMORHRVMHJ33X9.temp]- [targetUID: 00000000-00002004]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights\n \"aspnet_compiler.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"$38","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses powershell with an encoded commandline","description":"Process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANAA1AA==\" (UID: 00000000-00002004)","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-28","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds\n \"aspnet_compiler.exe\" sleeping for \"1566804069\" milliseconds\n \"aspnet_compiler.exe\" sleeping for \"01800000\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"48/68 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\Public\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\Public\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"smtp.yandex.com\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Type::GetProperties(System.Reflection.BindingFlags) at b3469fface251fb3d6a9e2da0d236802-600052e-ReflectionUtils~GetProperties\n System.Type::GetFields(System.Reflection.BindingFlags) at b3469fface251fb3d6a9e2da0d236802-600052f-ReflectionUtils~GetFields\n System.Dynamic.GetMemberBinder::get_Name() at b3469fface251fb3d6a9e2da0d236802-60004f2-JsonObject~TryGetMember\n System.Dynamic.ConvertBinder::get_Type() at b3469fface251fb3d6a9e2da0d236802-60004ef-JsonObject~TryConvert\n System.Dynamic.DynamicObject::TrySetIndex(System.Dynamic.SetIndexBinder,System.Object[],System.Object) at b3469fface251fb3d6a9e2da0d236802-60004f3-JsonObject~TrySetIndex\n System.Dynamic.DeleteMemberBinder::get_Name() at b3469fface251fb3d6a9e2da0d236802-60004f0-JsonObject~TryDeleteMember\n System.Dynamic.SetMemberBinder::get_Name() at b3469fface251fb3d6a9e2da0d236802-60004f4-JsonObject~TrySetMember","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$39","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"aspnet_compiler.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002092)\n \"powershell.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002004)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"\"aspnet_compiler.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\"\n \"aspnet_compiler.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\POCOMAIL\\ACCOUNTS.INI\"\n \"aspnet_compiler.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\"\n \"aspnet_compiler.exe\" opened file \"%APPDATA%\\POCOMAIL\\ACCOUNTS.INI\"","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"$3b","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contacts Mail Related Domain Names","description":"\"smtp.yandex.com\" is probably a mail server","origin":"Network Traffic","mitre_attack_id":"T1071.003","relevance":10,"id":"network-18","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"RegisterWaitForSingleObject\" (Source: f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.bin, API is part of module: KERNEL32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$3c","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"ipconfig.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"aspnet_compiler.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" - (UID: 00000000-00002092)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\".exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"48/68 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$3d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a typical mail related ports","description":"Mail traffic to 77.88.21.158 on port 587 (SMTP)","origin":"Network Traffic","mitre_attack_id":"T1071.003","relevance":6,"id":"network-10","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to gather system network configuration using IPCONFIG","description":"Process \"ipconfig.exe\" with commandline \"ipconfig /release\" (UID: 00000000-00003464)\n Process \"ipconfig.exe\" with commandline \"ipconfig /renew\" (UID: 00000000-00001428)","origin":"Monitored Target","mitre_attack_id":"T1016","relevance":5,"id":"target-137","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$3f","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00000000-00002092)\n Spawned process \"cmd.exe\" with commandline \"/c ipconfig /release\" (UID: 00000000-00003756)\n Spawned process \"ipconfig.exe\" with commandline \"ipconfig /release\" (UID: 00000000-00003464)\n Spawned process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANAA1AA==\" (UID: 00000000-00002004)\n Spawned process \"cmd.exe\" with commandline \"/c ipconfig /renew\" (UID: 00000000-00001724)\n Spawned process \"ipconfig.exe\" with commandline \"ipconfig /renew\" (UID: 00000000-00001428)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00001356)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00002384.00000000.67366.005C0000.00000004.mdmp\n 00000000-00002384.00000001.69286.005C0000.00000004.mdmp\n 00000000-00002384.00000002.71205.005C0000.00000004.mdmp\n 00000000-00002384.00000003.73007.005C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Observed string:\"powershell_ise.exe\" that explains how to use the PowerShell_ISEexe command-line tool. [Source: 00000000-00002384.00000001.69286.005C0000.00000004.mdmp\n 00000000-00002384.00000002.71205.005C0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Tries to gather system network configuration using IPCONFIG"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":138,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"641e106e05d1f24a0b000289","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["RUS"],"submit_name":"f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.exe","analysis_start_time":"2023-03-24T21:04:46+00:00","indicators_count":{"informative":125,"suspicious":37,"malicious":13},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"641dec4263665e405d0170d9","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["RUS"],"submit_name":"f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.exe","analysis_start_time":"2023-03-24T18:30:26+00:00","indicators_count":{"informative":125,"suspicious":35,"malicious":13},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"77.88.21.158","port":587,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]}],"dns_resolutions":[{"domain":"smtp.yandex.com","address":"77.88.21.158","ttl":119,"country":"Russian Federation","registrar_name":"Safenames Ltd","registrar_name_servers":"NS1.YANDEX.NET","registrar_creation_date":"1998-09-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"}],"processes":[{"pid":2092,"ppid":0,"name":"f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.exe","command_line":"","sha256":"f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2","normalized_path":"C:\\f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2.exe","uid":"00000000-00002092","icon":"$40"},{"pid":3756,"ppid":2092,"name":"cmd.exe","command_line":"/c ipconfig /release","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00002092","uid":"00000000-00003756"},{"pid":3464,"ppid":3756,"name":"ipconfig.exe","command_line":"ipconfig /release","sha256":"c0e3087d87c84776fe7ffca768a0793c02d28e34a821f0c9da32339af8e7e6a6","normalized_path":"%WINDIR%\\system32\\ipconfig.exe","parent_uid":"00000000-00003756","uid":"00000000-00003464"},{"pid":2004,"ppid":2092,"name":"powershell.exe","command_line":"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANAA1AA==","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002092","uid":"00000000-00002004"},{"pid":1724,"ppid":2092,"name":"cmd.exe","command_line":"/c ipconfig /renew","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00002092","uid":"00000000-00001724"},{"pid":1428,"ppid":1724,"name":"ipconfig.exe","command_line":"ipconfig /renew","sha256":"c0e3087d87c84776fe7ffca768a0793c02d28e34a821f0c9da32339af8e7e6a6","normalized_path":"%WINDIR%\\system32\\ipconfig.exe","parent_uid":"00000000-00001724","uid":"00000000-00001428"},{"pid":1356,"ppid":2092,"name":"aspnet_compiler.exe","command_line":"","sha256":"d7409d01e21b22084f3c166022c69ad46ddd7aaaff8eed6eb540961d3a196aea","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00002092","uid":"00000000-00001356"}],"all_imported_dlls":["sechost.dll","ucrtbase_clr0400.dll","shfolder.dll","System.Security.ni.dll","urlmon.dll","userenv.dll","winbrand.dll","schannel.dll","ole32.dll","msvcrt.dll","System.Core.ni.dll","System.Numerics.ni.dll","System.Drawing.ni.dll","rasadhlp.dll","ntdll.dll","System.Data.dll","bcrypt.dll","iertutil.dll","ntshrui.dll","WMINet_Utils.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","uxtheme.dll","shlwapi.dll","clrjit.dll","crypt32.dll","cfgmgr32.dll","mscorjit.dll","ncrypt.dll","gpapi.dll","gdi32.dll","ws2_32.dll","shell32.dll","apphelp.dll","ntdsapi.dll","version.dll","msasn1.dll","winnsi.dll","atl.dll","mscorwks.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","bcryptprimitives.dll","System.Data.ni.dll","api-ms-win-core-synch-l1-2-0.dll","Wldap32.dll","dhcpcsvc.dll","rpcss.dll","wbemcomn.dll","System.Transactions.dll","System.Xml.ni.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","dhcpcsvc6.dll","mswsock.dll","FWPUCLNT.DLL","clr.dll","System.Runtime.Serialization.ni.dll","System.Management.ni.dll","msctf.dll","propsys.dll","wininet.dll","kernel32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","fastprox.dll","api-ms-win-downlevel-version-l1-1-0.dll","tzres.dll","msvcr80.dll","fltLib.dll","profapi.dll","netutils.dll","System.Management.Automation.dll","wbemprox.dll","mscoree.dll","comctl32.dll","secur32.dll","IPHLPAPI.DLL","shdocvw.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","advapi32.dll","rpcrt4.dll","psapi.dll","nlssorting.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","srvcli.dll","System.Management.Automation.ni.dll","user32.dll","oleaut32.dll","api-ms-win-core-xstate-l2-1-0.dll","wmiutils.dll","Microsoft.VisualBasic.ni.dll","rsaenh.dll","ieframe.dll","mscorlib.ni.dll","Microsoft.PowerShell.Security.ni.dll","System.Configuration.ni.dll","RpcRtRemote.dll","KernelBase.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","vaultcli.dll","imm32.dll","Microsoft.PowerShell.Commands.Management.ni.dll","cryptbase.dll","clbcatq.dll","dwmapi.dll","wship6.dll","mscoreei.dll","cryptsp.dll","normaliz.dll","ntmarta.dll","Microsoft.WSMan.Management.ni.dll","System.Windows.Forms.ni.dll","sspicli.dll","linkinfo.dll","slc.dll","System.ni.dll","System.Transactions.ni.dll","setupapi.dll","devobj.dll","System.Configuration.Install.ni.dll","usp10.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","System.DirectoryServices.ni.dll","vcruntime140_clr0400.dll","Microsoft.WSMan.Runtime.dll","nsi.dll","dnsapi.dll","cscapi.dll","wbemsvc.dll","lpk.dll","mscorrc.dll","credssp.dll","WSHTCPIP.DLL","wow64.dll","wow64win.dll","System.Numerics.dll","wow64cpu.dll","System.Runtime.Serialization.dll","System.Security.dll","Culture.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"NNNLTOGMORHRVMHJ33X9.temp","sha256":"ac5c7f11175656ff3ee35feaea77584c0793e641069567e2464160d26b561f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"}]},{"name":"VXE2452UASZE5UPR6704.temp","sha256":"4733add76fce773ca06a947411a80c32ec6ead83a78e8ae48ee57c67cc059f00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"641dec4263665e405d0170d9"},{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"641e106e05d1f24a0b000289"}]}]}},"report_ids":{"sandbox_job_ids":["641e106e05d1f24a0b000289","641dec4263665e405d0170d9"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Matrioska.Generic Sample f797a3482808… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f797a3482808…. Malware family: Matrioska.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2"}],["$","meta","4",{"property":"og:title","content":"Malicious Matrioska.Generic Sample f797a3482808… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f797a3482808…. Malware family: Matrioska.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Matrioska.Generic Sample f797a3482808… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f797a3482808…. Malware family: Matrioska.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]]