26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware.Generic Sample fcb77ddb165e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fcb77ddb165e…. Malware family: Malware.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 12 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991","keywords":["Malicious","Malware.Generic","malware analysis","sandbox report","threat intelligence","fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991"],"about":{"@type":"SoftwareApplication","name":"playgamesonline.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware.Generic","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta16,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Dispose" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteTo" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Capacity" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin"28:Te1f,Found reference to "PbeSha1_RC2_40" (Indicator: "RC2"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "RC2_CBC_40" (Indicator: "RC2"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "SRTP_NULL_HMAC_SHA1_80" (Indicator: "HMAC"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "HMAC"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "HMAC_SHA1" (Indicator: "HMAC"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "EncryptionECDsaWithSha1" (Indicator: "ECDsa"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "TRAILER_SHA512" (Indicator: "SHA512"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "ecka_eg_X963kdf_SHA512" (Indicator: "SHA512"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "sphincs256_with_SHA512" (Indicator: "SHA512"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "xmss_with_SHA512" (Indicator: "SHA512"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "xmss_mt_with_SHA512" (Indicator: "SHA512"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "ecdsa_plain_SHA512" (Indicator: "SHA512"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "EncryptionECDsaWithSha512" (Indicator: "ECDsa"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "SRTP_NULL_HMAC_SHA1_32" (Indicator: "HMAC"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "HMAC"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "Aes192" (Indicator: "Aes"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "ECDsaWithSha2" (Indicator: "ECDsa"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "TRAILER_SHA512_224" (Indicator: "SHA512"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "EncryptionECDsaWithSha224" (Indicator: "ECDsa"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "RC2_64" (Indicator: "RC2"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found reference to "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin")29:T895,"playgamesonline.in.net.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "playgamesonline.in.net.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\6252DC40F71143A22FDE9EF7348E064251B18118") "playgamesonline.in.net.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\6252DC40F71143A22FDE9EF7348E064251B18118") "playgamesonline.in.net.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\627F8D7827656399D27D7F9044C9FEB3F33EFA9A") "playgamesonline.in.net.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\627F8D7827656399D27D7F9044C9FEB3F33EFA9A") "playgamesonline.in.net.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\67650DF17E8E7E5B8240A4F4564BCFE23D69C6F0") "playgamesonline.in.net.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\67650DF17E8E7E5B8240A4F4564BCFE23D69C6F0") "playgamesonline.in.net.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\71899A67BF33AF31BEFDC071F8F733B183856332") "playgamesonline.in.net.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\71899A67BF33AF31BEFDC071F8F733B183856332") "playgamesonline.in.net.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\74207441729CDD92EC7931D823108DC28192E2BB") "playgamesonline.in.net.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\74207441729CDD92EC7931D823108DC28192E2BB") "playgamesonline.in.net.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\742C3192E607E424EB4549542BE1BBC53E6174E2") "playgamesonline.in.net.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\742C3192E607E424EB4549542BE1BBC53E6174E2")2a:Tce3,Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "VerifyHash" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.DSA" and TypeReference "ExportParameters" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Seed" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Counter" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "P" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Q" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "G" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Y" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "X" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.RSA" and TypeReference "ExportParameters" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Modulus" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Exponent" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "D" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "P" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Q" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "DP" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "DQ" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "InverseQ" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference ".ctor" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin" Observed namespace "System.Security.Cryptography.RSA" and TypeReference "ImportParameters" in "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin"2b:T10cf,Found string "[PRIVATE KEY LOCATION: "{0}"]" (Indicator: "private key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Private key passed - public key expected." (Indicator: "private key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Private key passed - public key expected." (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Public Key:" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Public key presented not for certificate signature" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Public key certificate for attribute certificate cannot be searched." (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Subject public key cannot be decoded." (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Public key of issuer certificate of CRL could not be retrieved." (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Attribute certificate issuer is also a public key certificate issuer." (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Public key certificate specified in base certificate ID for attribute certificate cannot be found." (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Certification path for public key certificate of attribute certificate could not be build." (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Trusted CA Public Key:" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "expected public key" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Unrecognized curve OID for GostR3410x2001 private key" (Indicator: "private key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "algorithm identifier in private key not recognised" (Indicator: "private key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "error recovering GOST3410_2001 public key" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "invalid length for GOST3410_2001 public key" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "error recovering GOST3410_94 public key" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "error recovering GOST3410_2012 public key" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "invalid length for GOST3410_2012 public key" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "algorithm identifier in public key not recognised:" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Expected a public key" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "Expected a private key" (Indicator: "private key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "invalid DH public key" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "OID is not a valid public key parameter set" (Indicator: "public key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin") Found string "EOF encountered in middle of Ed25519 private key" (Indicator: "private key"; File: "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin")2c:T7d2,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to encrypt data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: YARA signature match - AES encryption2d:T130d,Found XOR loop in file "sample.bin" at offset 258202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 259603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 990241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1770740; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1896163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1259439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1259547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1482808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1848494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1848566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864316; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864622; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865162; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877402; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1930952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1967816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018324; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018846; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 312990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 733714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1028021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1190651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1227510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1347553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1382402; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1395450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1407626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1498080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1522495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1529421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1614875; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1619515; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1626045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1632265; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1638625; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1653995; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1657595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1680145; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1680845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1691365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2401016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3141732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3162069; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3197834; code bytes = 80302e:Tf07,">) at 22e5416bce4c473184a53900d4e823ff-60001d3-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyboardLayout(System.Int32) at 22e5416bce4c473184a53900d4e823ff-6000980-KeyboardNativeMethods~GetActiveKeyboard","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"playgamesonline.in.net.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Security\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Security.dll\" at 00000000-00000756-00000C17-2698311739\n \"playgamesonline.in.net.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.SqlXml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.SqlXml.dll\" at 00000000-00000756-00000C17-2698566753\n \"playgamesonline.in.net.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Web\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Web.dll\" at 00000000-00000756-00000C17-2742649104","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\" nuldel /a /q /f \"\" (Indicator: \"ping -\"; File: \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"), Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\ndel /a /q /f \\\"\" (Indicator: \"ping -\"; File: \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\")\n Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\nstart \\\"\\\" \\\"\" (Indicator: \"ping -\"; File: \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000756-00000C2C-2699029988\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$40","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000756-00000C2C-2699010157\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$41","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"BeginConnect\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"EndConnect\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"BeginReceive\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"EndReceive\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Connect\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"\n Observed namespace \"System.Net.Sockets\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"\n Observed namespace \"System.Net.Security\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"\n Observed namespace \"System.Net.NetworkInformation\" in \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00000756-00000C2C-2699010157\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$43","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00000756.00000000.236822.02C90000.00000004.mdmp\")\n Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00000756.00000001.238741.02C90000.00000004.mdmp\")\n Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00000756.00000002.240661.02C90000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"playgamesonline.in.net\" has high entropy\n Contacted domain: \"www.playgamesonline.in.net\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 8e6e5e26c545781f412f07aaaef7d20a","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://ipwho.is\"\n Found HTTPS url \"https://stackoverflow.com\"\n Found HTTPS url \"https://api.ipify.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.64.6\" on port \"443\"\n HTTPS traffic to \"172.67.173.185\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on file \"playgamesonline.in.net.exe.1114636450\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE9252282954F01BCE62836E871951]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000756.00000000.236822.02C90000.00000004.mdmp, 00000000-00000756.00000001.238741.02C90000.00000004.mdmp, 00000000-00000756.00000002.240661.02C90000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE70CDE4FE588FB799E8BE3227C649]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004500.00000000.236640.0319E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000756.00000000.236822.02C90000.00000004.mdmp, 00000000-00000756.00000001.238741.02C90000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004500.00000000.236640.0319E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"[Esc]

\" (Indicator: \"[esc]\"; File: \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\")\n Found string \"\"h\">[Tab]

\" (Indicator: \"[tab]\"; Source: \"00000000-00000756-00000CBE-2847706595\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"GetMac\" (Indicator: \"getmac\"; File: \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\")\n Found string \"HostName\" (Indicator: \"hostname\"; File: \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\")\n Found string \"hostname\" (Indicator: \"hostname\"; File: \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\")\n Found string \"'name' is not a HostName string\" (Indicator: \"hostname\"; File: \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\")\n Found string \"/K CHCP {0}\" (Indicator: \"chcp\"; File: \"fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$47","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$48","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del /a /q /f \"\" (Indicator: \"\"del \") in Source: fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege82\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00000756.00000000.236822.02C90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"playgamesonline.in.net.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"playgamesonline.in.net.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"MXQ2AIWDBDR4PPEWKFJFEFMMEKAFKDGJXVBM2YS20W5PB6GWDX3CXF0IF4VLRT7SKKNNQXTHWJJYZGI4JUMJGIYQQP28XGFMRWXMZJGWGGSCCBB9AGUPJ1\"; Value: \"F402000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a009213ea3cd399ee017079"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"