33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 40:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T8bb,Found reference to API "AsyncVoidMethodBuilder" (Indicator: "sync"; Source: "sample.bin"), Found reference to API ".WorstClassEver-state/receipt.json" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "HttpStatusCode" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "afterWrite" (Indicator: "write"; Source: "sample.bin"), Found reference to API "processTimer" (Indicator: "time"; Source: "sample.bin"), Found reference to API "set_ReadOnly" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SetStateMachine" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "WriteAllText" (Indicator: "write"; Source: "sample.bin"), Found reference to API "State" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "AsyncCallback" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "WriteActivity" (Indicator: "write"; Source: "sample.bin"), Found reference to API "Duplicate archive entry." (Indicator: "dup"; Source: "sample.bin"), Found reference to API "ReadInt32" (Indicator: "read"; Source: "sample.bin"), Found reference to API "<>l__initialThreadId" (Indicator: "read"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=6" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "state" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "ThreadCountKnown" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ReadUInt16" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_Timeout" (Indicator: "time"; Source: "sample.bin"), Found reference to API "set_SelectedPath" (Indicator: "select"; Source: "sample.bin"), Found reference to API "AsyncStateMachineAttribute" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "AsyncStateMachineAttribute" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ReadUInt32" (Indicator: "read"; Source: "sample.bin"), Found reference to API "System.Runtime.CompilerServices" (Indicator: "time"; Source: "sample.bin")36:T84c,Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileName"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBox"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeThread"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassName"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAllocEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API (Indicator: "DrawText"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "WriteProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessById"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryEx"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFreeEx"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CreateRemoteThread"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")37:T107b,"WorstClassEver.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter MessageBox (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007780) "WorstClassEver.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007780)38:T5ce,Observed unmanaged function "EnumWindows" in "WorstClassEver.exe" Observed unmanaged function "IsWindowVisible" in "WorstClassEver.exe" Observed unmanaged function "IsHungAppWindow" in "WorstClassEver.exe" Observed unmanaged function "GetClassName" in "WorstClassEver.exe" Observed unmanaged function "GetWindowText" in "WorstClassEver.exe" Observed unmanaged function "GetWindowThreadProcessId" in "WorstClassEver.exe" Observed unmanaged function "OpenProcess" in "WorstClassEver.exe" Observed unmanaged function "IsWow64Process" in "WorstClassEver.exe" Observed unmanaged function "GetModuleHandle" in "WorstClassEver.exe" Observed unmanaged function "GetProcAddress" in "WorstClassEver.exe" Observed unmanaged function "LoadLibraryEx" in "WorstClassEver.exe" Observed unmanaged function "FreeLibrary" in "WorstClassEver.exe" Observed unmanaged function "GetExitCodeThread" in "WorstClassEver.exe" Observed unmanaged function "GetModuleHandleEx" in "WorstClassEver.exe" Observed unmanaged function "GetModuleFileName" in "WorstClassEver.exe" Observed unmanaged function "VirtualAllocEx" in "WorstClassEver.exe" Observed unmanaged function "WriteProcessMemory" in "WorstClassEver.exe" Observed unmanaged function "VirtualFreeEx" in "WorstClassEver.exe" Observed unmanaged function "CreateRemoteThread" in "WorstClassEver.exe" Observed unmanaged function "WaitForSingleObject" in "WorstClassEver.exe" Observed unmanaged function "CloseHandle" in "WorstClassEver.exe"39:T567,"WorstClassEver.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "WorstClassEver.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CCG"; Key: ""; Value: "") "WorstClassEver.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "WorstClassEver.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "WorstClassEver.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WORSTCLASSEVER.EXE"; Key: ""; Value: "") "WorstClassEver.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "WorstClassEver.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "WorstClassEver.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WorstClassEver.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WorstClassEver.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "WorstClassEver.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")3a:Tc2a,"WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSLEEPLOOPWINDOWSIZE"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSPINCOUNTTHRESHOLD"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYBASEYIELD"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTFACTORYIELD"; Value: "") "WorstClassEver.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYMAXYIELD"; Value: "")3b:T458,"WorstClassEver.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL" "WorstClassEver.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "WorstClassEver.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "WorstClassEver.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" "WorstClassEver.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WorstClassEver.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WorstClassEver.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WorstClassEver.exe" trying to touch file "C:\WorstClassEver.exe.config" "WorstClassEver.exe" trying to touch file "C:\WorstClassEver.exe" "WorstClassEver.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernel.appcore.dll" "WorstClassEver.exe" trying to touch file "C:\Windows\System32\kernel.appcore.dll" "WorstClassEver.exe" trying to touch file "C:\WINDOWS\SYSTEM32\VERSION.dll" "WorstClassEver.exe" trying to touch file "C:\Windows\System32\version.dll"3c:T53d,"WorstClassEver.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WorstClassEver.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "WorstClassEver.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "WorstClassEver.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "WorstClassEver.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "WorstClassEver.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "WorstClassEver.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "WorstClassEver.exe" trying to access non-existent file "C:\FLTLIB.DLL" "WorstClassEver.exe" trying to access non-existent file "C:\MSVCP140.dll" "WorstClassEver.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "WorstClassEver.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "WorstClassEver.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "WorstClassEver.exe" trying to access non-existent file "C:\CRYPTBASE.DLL"3d:T550,Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00007780.00000000.255488.00A60000.00000004.mdmp, 00000000-00007780.00000001.255642.00A60000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007780.00000000.255488.00A60000.00000004.mdmp, 00000000-00007780.00000000.255488.00BB0000.00000004.mdmp, 00000000-00007780.00000000.255488.00BE0000.00000004.mdmp, 00000000-00007780.00000001.255642.00A60000.00000004.mdmp, 00000000-00007780.00000001.255642.00BB0000.00000004.mdmp, 00000000-00007780.00000001.255642.00BE0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007780.00000000.255488.00A60000.00000004.mdmp, 00000000-00007780.00000000.255488.00BB0000.00000004.mdmp, 00000000-00007780.00000000.255488.00BE0000.00000004.mdmp, 00000000-00007780.00000001.255642.00A60000.00000004.mdmp, 00000000-00007780.00000001.255642.00BB0000.00000004.mdmp, 00000000-00007780.00000001.255642.00BE0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\WorstClassEver.exe" (Indicator: "\Device\"; Source: "00000000-00007780.00000000.255488.00A60000.00000004.mdmp, 00000000-00007780.00000001.255642.00A60000.00000004.mdmp")3e:T7fa,Found string "EnumWindows" (Source: WorstClassEver.exe, API is part of module: USER32.DLL) Found string "IsWindowVisible" (Source: WorstClassEver.exe, API is part of module: USER32.DLL) Found string "IsHungAppWindow" (Source: WorstClassEver.exe, API is part of module: USER32.DLL) Found string "GetWindowThreadProcessId" (Source: WorstClassEver.exe, API is part of module: USER32.DLL) Found string "Rectangle" (Source: WorstClassEver.exe, API is part of module: GDI32FULL.DLL) Found string "OpenProcess" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "IsWow64Process" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "GetProcAddress" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "GetExitCodeThread" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "VirtualAllocEx" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "WriteProcessMemory" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "VirtualFreeEx" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "CreateRemoteThread" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "WaitForSingleObject" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "FillPath" (Source: WorstClassEver.exe, API is part of module: GDI32FULL.DLL) Found string "Escape" (Source: WorstClassEver.exe, API is part of module: GDI32.DLL) Found string "CloseFigure" (Source: WorstClassEver.exe, API is part of module: GDI32FULL.DLL) Found string "ReleaseMutex" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryW" (Source: WorstClassEver.exe, API is part of module: KERNELBASE.DLL)3f:T6b0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEyUlEQVR4XsVX6Y9TVRR//4gfTDQRxEFgukH1gwrEqInRxGjUEB0Z6N4aOuOORGNcwgcRTIBgEBPj8sEtYQQT1C/iGgFBmLbTdqadTgeny+xb2+P5ndv35rUzk85Aqyc5fcu995zfPed3z+vRNAgRyZXFEuwnRyhNdn8/Wb191O6OXpfCBmzZ/SnaHMwYfrS9us+qc6frAjl8A2T18cRQljY/O9xkzbJt3pR/gBzuS8q5gOAfp4sR+uLkDBfJxogt3mhL1OaN0ZY9OfaV4shcIexegGDAGR4lqxuT+lqrbgXC6onRXkTA5uoliydONg8mxBYvaIFa2I8jOEhWVwQAIpJzFaLFk1uh8CWc8ERJs3gjQpJ6AHZfH5NSKe7rjTQc9y4/jghg0wIAx2QpALfvihnaznmDQbNxvNPHN+yqTZ0aX7CxYXftuA7A5o2ThrNaDwCIH943QI+8pnRbd4IsbpMBvr+nK2GMP/TqQI1zC/Pprj0L4w++wsdPOFYHgIm4CACcb2TEF+IzpMs3Z8do7dM8z8/R8sdpbUdU3kEqFaLp2Qo98FK/rHMG4rTmqSgd68mrcdaTv47TrR1YH28MAJNuYQPHTxUMANHBWdk1wGEnW9hJJjcvY/MluCDqOpoVJ85gnG7bGaWzf08a6/edGKY1soEVAHDwLtc9EyXvexnDAHZ4/4v9ktf1nNMdb6VlZ9BSuSLXj88UxAlA3hGKUzavAM7NVyRF4AkI2RAADGxyxSTHo5NlA4T/YIbWd8Zklwe+GJF3kzNlUcjFxDS1uxQhH309ReXq0khaRU/Pf0MAEgUG0bYzRj9fntL90/tf5yT3cPDTJRXei8kZ+iuhuAIg4MHNOyL08vFhY91nPxRrwr8iADoPDn2VMwz9eH5CyLX9uSQVxkvyDjw5elKRDRI+MkQ3PNZLn3xfNN51HVHcAIFXDAA8aGMidexPG4ZAOqTAf2iBGz5Oi+vdQeP5o++KdOMTvfRnbFqeJ6bLdN8LSdrIqTEXo4YA9LN8J5PpalGRiblGW7keHOtRpwPEvPf5pNSIqVl1Ev6ITEn0RkZVhM4xEKRsuUq4LAA9Cus4dGfOTYgxSPjwEP1yRfECdQJkNdeM4cK8kFU/mh98m5dUmvO/YgBYBPK88+k/BoBTv42LE8iJ0wU5rtAPTy9EpYeLji6eAxkZx2ZWDQAnATl//I2UVDtIfqwk5xqCnbZ1RkUDVV6U+OjlqwQtTpTo7nBCfUeuJQVQVD2gT12dEw7AAcCMcX3Y2p2UwgTdzvfjU2UZQ/gxF0cVFbF+96sCIHWf02AOK+R3JhtOCYzrkdKZr8vBL3NL5n/VAJDDbq7zyewcRbmq4fo280L/uEBxv//zERnry6g5T76ZFmB6+b0mAMYC06d0qWfzO/1/g/nzW681AKzexgCarQYAvmry8D8BQJQ0q1s9/LcAOOqhIemaNLsHjhOSj/qJrVIAcIQyzJuYakwsngg3C3lpGuonN1+rKWefN/ki0h3xHwn+J8M9m3Qsbr2VijVZuVF1qxbAEUyRYzecGw2iprVzh2QLcOMYTMsk8KKpyo2Ig7tjuz9Nls7Lpua05kbTHAzCHkiRzZeQcAk3rkdhg7tiWwCaok2dh8WX9IUs/wLdi60ajI5cfwAAAABJRU5ErkJggg==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample fc3dde4361b2… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample fc3dde4361b2…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/fc3dde4361b2aa020f3dd1b47b081f8a7c17a62960ae9bdeffceff69f11d86bf\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"fc3dde4361b2aa020f3dd1b47b081f8a7c17a62960ae9bdeffceff69f11d86bf\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"WorstClassEver.exe\",\"applicationCategory\":[\"peexe\",\"64bits\",\"assembly\",\"executable\"],\"identifier\":\"fc3dde4361b2aa020f3dd1b47b081f8a7c17a62960ae9bdeffceff69f11d86bf\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":27},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":7},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"fc3dde4361b2aa020f3dd1b47b081f8a7c17a62960ae9bdeffceff69f11d86bf","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794378527136,"unified_at":"2026-11-11T06:28:47.136Z","metadata":{"hashes":{"sha256":"fc3dde4361b2aa020f3dd1b47b081f8a7c17a62960ae9bdeffceff69f11d86bf","sha1":"2917b2c5fe86b9611d4ce9d16e5af9301f2ae2b8","md5":"b225809f93f7b82acef790b5a8faf714","sha512":"aa94046aa55d70410e69cd8624a69da5f6282ffc5a2ae56ffadf6742bb38e55ab9edc68d29f4448362490291f5d97eb721d850755030c4b65d4b9cdd39fdce0b","ssdeep":"3072:1D6DuBbJF620thxOf/wdqwatNfqeH4jKG4aJwDlzzFwaPN:8uBbJF620thxOf/aqwEfqdjujwe","ssdeep_chunks":["3072:1D6DuBb","3072:D6DuBbJ","3072:6DuBbJF","3072:DuBbJF6","3072:uBbJF62","3072:BbJF620","3072:bJF620t","3072:JF620th","3072:F620thx","3072:620thxO","3072:20thxOf","3072:0thxOf/","3072:thxOf/w","3072:hxOf/wd","3072:xOf/wdq","3072:Of/wdqw","3072:f/wdqwa","3072:/wdqwat","3072:wdqwatN","3072:dqwatNf","3072:qwatNfq","3072:watNfqe","3072:atNfqeH","3072:tNfqeH4","3072:NfqeH4j","3072:fqeH4jK","3072:qeH4jKG","3072:eH4jKG4","3072:H4jKG4a","3072:4jKG4aJ","3072:jKG4aJw","3072:KG4aJwD","3072:G4aJwDl","3072:4aJwDlz","3072:aJwDlzz","3072:JwDlzzF","3072:wDlzzFw","3072:DlzzFwa","3072:lzzFwaP","3072:zzFwaPN","6144:1D6DuBb","6144:D6DuBbJ","6144:6DuBbJF","6144:DuBbJF6","6144:uBbJF62","6144:BbJF620","6144:bJF620t","6144:JF620th","6144:F620thx","6144:620thxO","6144:20thxOf","6144:0thxOf/","6144:thxOf/w","6144:hxOf/wd","6144:xOf/wdq","6144:Of/wdqw","6144:f/wdqwa","6144:/wdqwat","6144:wdqwatN","6144:dqwatNf","6144:qwatNfq","6144:watNfqe","6144:atNfqeH","6144:tNfqeH4","6144:NfqeH4j","6144:fqeH4jK","6144:qeH4jKG","6144:eH4jKG4","6144:H4jKG4a","6144:4jKG4aJ","6144:jKG4aJw","6144:KG4aJwD","6144:G4aJwDl","6144:4aJwDlz","6144:aJwDlzz","6144:JwDlzzF","6144:wDlzzFw","6144:DlzzFwa","6144:lzzFwaP","6144:zzFwaPN","3072:8uBbJF6","3072:thxOf/a","3072:hxOf/aq","3072:xOf/aqw","3072:Of/aqwE","3072:f/aqwEf","3072:/aqwEfq","3072:aqwEfqd","3072:qwEfqdj","3072:wEfqdju","3072:Efqdjuj","3072:fqdjujw","3072:qdjujwe"]},"file_info":{"file_name":"WorstClassEver.exe","file_type":["peexe","64bits","assembly","executable"],"file_type_id":"64-bit .NET exe","file_size":123904,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794378425000,"last_seen":1794378425000,"last_multi_scan":1794378425000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":43},"sandbox_signatures":{"informative_count":108,"suspicious_count":7,"malicious_count":0,"total":115},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":".NET code is able to query registry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Able to access Steam setting"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to download remote files (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to load content into memory (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$35","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-615","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\WOW6432Node\\Valve\\Steam\" in Source: sample.bin, \"Software\\Valve\\Steam\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), Found reference to API \"EnumWindowsProc\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"sample.bin\"), Found reference to API \"EnumWindowsProc\" (Indicator: \"enumwindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"ZipFile\" (Indicator: \"zipfile\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleEx\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleEx\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; Source: \"sample.bin\"), Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-217","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access Steam setting","description":"Found string \"SOFTWARE\\WOW6432Node\\Valve\\Steam\" (Indicator: \"software\\wow6432node\\valve\\steam\"; Source: \"sample.bin\"), Found string \"Software\\Valve\\Steam\" (Indicator: \"software\\valve\\steam\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518","id":"string-763","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"b__c\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"b__d\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"b__e\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"b__f\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryEx\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\"), Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"sample.bin\"), Found reference to API \"VirtualFreeEx\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-79","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"b__c\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"b__d\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"b__e\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"b__f\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryEx\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\", Pattern match: \"http://howtofish.yeahs.icu/wce/releases/latest.json\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.9.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"ZipArchiveEntry\" (Source: \"00000000-00007780.00000000.255488.001F2000.00000002.mdmp\")\n Found string \"ZipFile\" (Source: \"00000000-00007780.00000000.255488.001F2000.00000002.mdmp\")\n Found string \"ZipArchive\" (Source: \"00000000-00007780.00000000.255488.001F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetLastWin32Error\" in \"WorstClassEver.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"WorstClassEver.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.ZipArchiveEntry\" in \"WorstClassEver.exe\"\n Observed function \"System.IO.Compression.ZipFile\" in \"WorstClassEver.exe\"\n Observed function \"System.IO.Compression.ZipArchive\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"WorstClassEver.exe has big resource with name: \"WorstClassEver.Launcher.Assets.wce.ico\" size: \"19097\" and abnormal entropy:\"7.927882163507501\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WorstClassEver.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"WorstClassEver.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"WorstClassEver.exe\" queried SystemProcessInformation at 00000000-00007780-00000C15-2193349278 [PID: 7780]\n \"WorstClassEver.exe\" queried SystemProcessInformation at 00000000-00007780-00000C15-2193357326 [PID: 7780]\n \"WorstClassEver.exe\" queried SystemProcessInformation at 00000000-00007780-00000C15-2193546846 [PID: 7780]\n \"WorstClassEver.exe\" queried SystemProcessInformation at 00000000-00007780-00000C15-2193553472 [PID: 7780]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007780.00000000.255488.00A60000.00000004.mdmp, 00000000-00007780.00000001.255642.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"WorstClassEver.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007780.00000000.255488.00A60000.00000004.mdmp, 00000000-00007780.00000001.255642.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007780.00000000.255488.00A60000.00000004.mdmp, 00000000-00007780.00000001.255642.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform crypto operations","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 68679; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 47007; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 116504; code bytes = 33c1","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"WorstClassEver.exe\"\n Observed dotnet function \"GetFileSystemEntries\" in \"WorstClassEver.exe\"\n Observed dotnet function \"GetDirectories\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WorstClassEver.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007780)\n \"WorstClassEver.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007780)\n \"WorstClassEver.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007780)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WorstClassEver.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007780)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"WorstClassEver.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00007780)\n \"WorstClassEver.exe\" called \"GetWindowTextW\" with parameter \"004e2e95a9524b62f25d5362005f0cfff78bd48fde56f25d0967977ae3530230\" - (UID: 00000000-00007780)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"WorstClassEver.exe\" called \"GetActiveWindow\" (UID: 00000000-00007780)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WorstClassEver.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007780)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"WorstClassEver.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007780)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) at b225809f93f7b82acef790b5a8faf714-6000031-LauncherDiagnostics~Inspect","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WorstClassEver.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"WorstClassEver.Launcher.NativeLoader::OpenProcess(System.UInt32,System.Boolean,System.Int32) at b225809f93f7b82acef790b5a8faf714-600007f-NativeLoader~LoadLibrary","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"WorstClassEver.exe\" queried token user identity (UID: 00000000-00007780)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"WorstClassEver.exe\" queries volume information of \"C:\\WorstClassEver.exe\" at 00000000-00007780-00000C17-2193145290","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WorstClassEver.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"WorstClassEver.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"GetProcAddress\" in \"WorstClassEver.exe\"\n Observed API \"LoadLibraryEx\" in \"WorstClassEver.exe\"\n Observed API \"VirtualAllocEx\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00007780.00000000.255488.001F2000.00000002.mdmp\")\n Found string \"set_UseShellExecute\" (Source: \"00000000-00007780.00000000.255488.001F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineArgs\" (Source: \"00000000-00007780.00000000.255488.001F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"WorstClassEver.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00007780)\n \"WorstClassEver.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00007780)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$37","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"WorstClassEver.exe\"\n Observed function \"Process.get_StartTime\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process WorstClassEver.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:7780:304:WilStaging_02\"\n Process WorstClassEver.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7780:304:WilStaging_02\"\n Process WorstClassEver.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\WorstClassEverLauncher\"\n Process WorstClassEver.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:7780:120:WilError_03\"\n Process WorstClassEver.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7780:120:WilError_03\"\n Process WorstClassEver.exe created mutex with name \"Local\\SM0:7780:120:WilError_03\"\n Process WorstClassEver.exe created mutex with name \"Local\\SM0:7780:304:WilStaging_02\"\n Process WorstClassEver.exe created mutex with name \"WorstClassEverLauncher\"\n Process WorstClassEver.exe created mutex with name \"SM0:7780:304:WilStaging_02\"\n Process WorstClassEver.exe created mutex with name \"SM0:7780:120:WilError_03\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"WorstClassEver.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$38","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00007780.00000001.255642.00A60000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"WorstClassEver.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffdbdec0000\n \"WorstClassEver.exe\" loaded module \"USER32.DLL\" at base 7ffdec1b0000\n \"WorstClassEver.exe\" loaded module \"OLE32.DLL\" at base 7ffdec410000\n \"WorstClassEver.exe\" loaded module \"COMCTL32.DLL\" at base 7ffdcff40000\n \"WorstClassEver.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSCTF.DLL\" at base 7ffdec090000\n \"WorstClassEver.exe\" loaded module \"API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL\" at base 7ffdea970000\n \"WorstClassEver.exe\" loaded module \"EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL\" at base 7ffdec1b0000\n \"WorstClassEver.exe\" loaded module \"EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL\" at base 7ffdec1b0000\n \"WorstClassEver.exe\" loaded module \"RPCRT4.DLL\" at base 7ffdeb080000\n \"WorstClassEver.exe\" loaded module \"API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0\" at base 7ffdebc50000\n \"WorstClassEver.exe\" loaded module \"%WINDIR%\\SYSTEM32\\OLE32.DLL\" at base 7ffdec410000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"WorstClassEver.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at B12F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WorstClassEver.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at EA050000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"WorstClassEver.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at B2980000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WorstClassEver.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EB080000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"WorstClassEver.exe\" was detected as \".NET\" and name: \"Library\"\n \"WorstClassEver.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"WorstClassEver.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"WorstClassEver.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"WorstClassEver.exe\" file has an entrypoint instructions - \"pop\tr10,nop\t,add\tbyte ptr [rbx], al,add\tbyte ptr [rax], al,add\tbyte ptr [rax + rax], al,add\tbyte ptr [rax], al,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"WorstClassEver.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WorstClassEver.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WorstClassEver.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WorstClassEver.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WorstClassEver.exe\" queries basic process information of the \"C:\\WorstClassEver.exe\" (UID: 7780)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WorstClassEver.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"WorstClassEver.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll.aux\"\n \"WorstClassEver.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\bee998043eb1e9badecd282a79540a5e\\system.windows.forms.ni.dll.aux\"\n \"WorstClassEver.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\ce0fd4f5b50baa17e7b80e4ee874ad11\\system.ni.dll.aux\"\n \"WorstClassEver.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\3c82a5286b5172d5a68c8df2e09c4c40\\system.drawing.ni.dll.aux\"\n \"WorstClassEver.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WorstClassEver.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL.local\"\n \"WorstClassEver.exe\" trying to access non-existent file \"C:\\WorstClassEver.exe.config\"\n \"WorstClassEver.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.localgac\"\n \"WorstClassEver.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WorstClassEver\"\n \"WorstClassEver.exe\" trying to access non-existent file \"C:\\WorstClassEver.INI\"\n \"WorstClassEver.exe\" trying to access non-existent file \"C:\\WorstClassEver.exe.Local\\\"\n \"WorstClassEver.exe\" trying to access non-existent file \"C:\\Windows\\SystemResources\\USER32.dll.mun\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"WorstClassEver.exe\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.HttpWebResponse\" and MemberReference \"get_StatusCode\" in \"WorstClassEver.exe\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_ReadWriteTimeout\" in \"WorstClassEver.exe\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_UserAgent\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"WorstClassEver.exe\"\n Observed namespace \"System.Net.Cache\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEDBC99BF783B6F61D54C4960384F2]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007780.00000000.255488.00A60000.00000004.mdmp, 00000000-00007780.00000001.255642.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007780.00000000.255488.00A60000.00000004.mdmp, 00000000-00007780.00000001.255642.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00007780.00000000.255488.00A60000.00000004.mdmp, 00000000-00007780.00000001.255642.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00007780.00000000.255488.001F2000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00007780.00000000.255488.001F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WorstClassEver.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessesByName\" in \"WorstClassEver.exe\"\n Observed function \"GetProcessById\" in \"WorstClassEver.exe\"\n Observed function \"get_ProcessName\" in \"WorstClassEver.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at b225809f93f7b82acef790b5a8faf714-6000032-LauncherDiagnostics~IsElevated","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WorstClassEver.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"WorstClassEver.exe\" was detected as \"Microsoft Visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"WorstClassEver.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7780)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"WorstClassEver.exe\" has section name .rsrc with entropy \"7.677284632728983\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"WorstClassEver.exe\" has resource with unusual entropy \"RT_ICON:7.674648980787932\"\n \"WorstClassEver.exe\" has resource with unusual entropy \"RT_ICON:7.818080887760983\"\n \"WorstClassEver.exe\" has resource with unusual entropy \"RT_ICON:7.897261276825608\"\n \"WorstClassEver.exe\" has resource with unusual entropy \"RT_ICON:7.901466732913961\"\n \"WorstClassEver.exe\" has resource with unusual entropy \"RT_ICON:7.950724295018618\"\n \"WorstClassEver.exe\" has resource with unusual entropy \"RT_ICON:7.727273560178961\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"suspicious","category":"General","name":"PE file with no import directory","description":"\"WorstClassEver.exe\" has no \"IMAGE_DIRECTORY_ENTRY_IMPORT\"","origin":"Static Parser","relevance":5,"id":"static-90","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"WorstClassEver.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1010890\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"WorstClassEver.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"60107e7\"\n \"cx\": \"75\"\n \"cy\": \"23\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessesByName(System.String) at b225809f93f7b82acef790b5a8faf714-600000f-GameLocator~Detect\n System.Diagnostics.Process::GetProcessesByName(System.String) at b225809f93f7b82acef790b5a8faf714-600001f-GameProcess~Detect\n System.Diagnostics.Process::GetProcessById(System.Int32) at b225809f93f7b82acef790b5a8faf714-600007d-NativeLoader~InjectSelectedGame","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6af40ab8a09bcbcbc503b7e5","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"WorstClassEver.exe","analysis_start_time":"2026-11-11T06:27:05+00:00","indicators_count":{"informative":107,"suspicious":14,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}],"processes":[{"pid":7780,"ppid":0,"name":"WorstClassEver.exe","command_line":"","sha256":"fc3dde4361b2aa020f3dd1b47b081f8a7c17a62960ae9bdeffceff69f11d86bf","normalized_path":"C:\\WorstClassEver.exe","uid":"00000000-00007780","icon":"$3f"}],"all_imported_dlls":["msvcrt.dll","rpcrt4.dll","gdi32full.dll","ucrtbase.dll","psapi.dll","System.Drawing.ni.dll","fltLib.dll","ntdll.dll","sechost.dll","shlwapi.dll","vcruntime140_clr0400.dll","ucrtbase_clr0400.dll","msvcp_win.dll","clrjit.dll","System.ni.dll","mscoree.dll","System.Windows.Forms.ni.dll","vcruntime140.dll","TextShaping.dll","comctl32.dll","kernel.appcore.dll","ws2_32.dll","msvcp140.dll","vcruntime140_1.dll","cryptsp.dll","TextInputFramework.dll","SHCore.dll","clbcatq.dll","mscoreei.dll","clr.dll","user32.dll","ole32.dll","bcryptprimitives.dll","CoreMessaging.dll","CoreUIComponents.dll","kernel32.dll","version.dll","vcruntime140_1_clr0400.dll","win32u.dll","gdi32.dll","imm32.dll","mscorlib.ni.dll","combase.dll","uxtheme.dll","VxSSL64.dll","oleaut32.dll","msctf.dll","advapi32.dll","WinTypes.dll","cryptbase.dll","KernelBase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7780:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7780:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WorstClassEverLauncher","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7780:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7780:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"name":"Local\\SM0:7780:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"name":"Local\\SM0:7780:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"name":"WorstClassEverLauncher","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"name":"SM0:7780:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]},{"name":"SM0:7780:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af40ab8a09bcbcbc503b7e5"}]}]}},"report_ids":{"sandbox_job_ids":["6af40ab8a09bcbcbc503b7e5"]}}}]]}] 2c:[["$","title","0",{"children":"Sample fc3dde4361b2… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample fc3dde4361b2…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fc3dde4361b2aa020f3dd1b47b081f8a7c17a62960ae9bdeffceff69f11d86bf"}],["$","meta","4",{"property":"og:title","content":"Sample fc3dde4361b2… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample fc3dde4361b2…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fc3dde4361b2aa020f3dd1b47b081f8a7c17a62960ae9bdeffceff69f11d86bf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample fc3dde4361b2… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample fc3dde4361b2…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L40","11",{}]] 32:null