24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Imps.Generic Sample 15208030eda4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 15208030eda4…. Malware family: Ransom.Imps.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10","keywords":["Malicious","Ransom.Imps.Generic","malware analysis","sandbox report","threat intelligence","15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10"],"about":{"@type":"SoftwareApplication","name":"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin","applicationCategory":["peexe","executable"],"identifier":"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Imps.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T462,Found reference string "NetGroupGetInfo" (Indicator: "netgroupgetinfo"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference string "NetGroupGetUsers" (Indicator: "netgroupgetusers"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference string "NetGroupEnum" (Indicator: "netgroupenum"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference string "NetUserGetGroups" (Indicator: "netusergetgroups"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference string "NetGroupGetInfo" (Indicator: "netgroupgetinfo"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference string "NetGroupGetUsers" (Indicator: "netgroupgetusers"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference string "NetGroupEnum" (Indicator: "netgroupenum"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference string "NetUserGetGroups" (Indicator: "netusergetgroups"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp")26:T9e2,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "SamFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "SamFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "DsRoleFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "DsRoleFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp")27:Tb0e,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp")28:T7c4,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp")29:T809,"net1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "net1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "net1.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "net1.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "net1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "net1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "net1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY") "net1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "net1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "net1.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "net1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NET1.EXE") "net1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING") "net1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\OLEAUT") "net1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "net1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "net1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "net1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "net1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE") "net1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS") "net1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS")2a:T9b4,"" (Indicator: "GetDC"; Source: "00000000-00005324.00000000.173774.00610000.00000004.mdmp, 00000000-00005324.00000001.175695.00610000.00000004.mdmp, 00000000-00005324.00000002.177614.00610000.00000004.mdmp, 00000000-00005324.00000003.184632.00610000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005324.00000000.173774.00610000.00000004.mdmp, 00000000-00005324.00000001.175695.00610000.00000004.mdmp, 00000000-00005324.00000002.177614.00610000.00000004.mdmp, 00000000-00005324.00000003.184632.00610000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005324.00000000.173774.00610000.00000004.mdmp, 00000000-00005324.00000001.175695.00610000.00000004.mdmp, 00000000-00005324.00000002.177614.00610000.00000004.mdmp, 00000000-00005324.00000003.184632.00610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005324.00000000.173774.00610000.00000004.mdmp, 00000000-00005324.00000001.175695.00610000.00000004.mdmp, 00000000-00005324.00000002.177614.00610000.00000004.mdmp, 00000000-00005324.00000003.184632.00610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005324.00000000.173774.00610000.00000004.mdmp, 00000000-00005324.00000001.175695.00610000.00000004.mdmp, 00000000-00005324.00000002.177614.00610000.00000004.mdmp, 00000000-00005324.00000003.184632.00610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005324.00000000.173774.00610000.00000004.mdmp, 00000000-00005324.00000001.175695.00610000.00000004.mdmp, 00000000-00005324.00000002.177614.00610000.00000004.mdmp, 00000000-00005324.00000003.184632.00610000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005324.00000000.173774.00610000.00000004.mdmp, 00000000-00005324.00000001.175695.00610000.00000004.mdmp, 00000000-00005324.00000002.177614.00610000.00000004.mdmp, 00000000-00005324.00000003.184632.00610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005324.00000000.173774.00610000.00000004.mdmp, 00000000-00005324.00000001.175695.00610000.00000004.mdmp, 00000000-00005324.00000002.177614.00610000.00000004.mdmp, 00000000-00005324.00000003.184632.00610000.00000004.mdmp")44:Tcee,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp")45:T490,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp")46:T5f2,Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp")47:Tc38,Found reference to API "LookupAccountSidLocalW" (Indicator: "LookupAccountSid"; File: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "LookupAccountNameLocalW" (Indicator: "LookupAccountName"; File: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; File: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; File: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "LsaLookupNames" (Indicator: "LsaLookupNames"; File: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "LookupAccountSidLocalW" (Indicator: "LookupAccountSid"; Source: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "LookupAccountNameLocalW" (Indicator: "LookupAccountName"; Source: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; Source: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; Source: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "LsaLookupNames" (Indicator: "LsaLookupNames"; Source: "00000000-00001744.00000000.176801.00911000.00000020.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "NetWkstaUserGetInfo" (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "NetWkstaUserGetInfo" (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp")48:T5cb,Found string "\Device\HarddiskVolume2\Windows\SysWOW64\net1.exe" (Indicator: "\Device\"; Source: "00000000-00001316.00000000.177452.005F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\net1.exe" (Indicator: "\Device\"; Source: "00000000-00001984.00000000.180708.00770000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\net1.exe" (Indicator: "\Device\"; Source: "00000000-00004032.00000000.182660.00730000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\net1.exe" (Indicator: "\Device\"; Source: "00000000-00004708.00000000.183636.006C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin.exe" (Indicator: "\Device\"; Source: "00000000-00005324.00000000.173774.00610000.00000004.mdmp, 00000000-00005324.00000001.175695.00610000.00000004.mdmp, 00000000-00005324.00000002.177614.00610000.00000004.mdmp, 00000000-00005324.00000003.184632.00610000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\net1.exe" (Indicator: "\Device\"; Source: "00000000-00005740.00000000.179405.00610000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\net1.exe" (Indicator: "\Device\"; Source: "00000000-00007748.00000000.180382.00710000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\net1.exe" (Indicator: "\Device\"; Source: "00000000-00008132.00000000.177778.005B0000.00000004.mdmp")49:Tf35,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "RtlInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "RtlCopySid" (Indicator: "CopySid"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp")4a:Tc5e,Found string "net stop "Acronis VSS Provider" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-2300121566") Found string "net stop "Enterprise Client Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-14816460232") Found string "net stop "Sophos Agent" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-27036006290") Found string "net stop "Sophos AutoUpdate Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-39257615954") Found string "net stop "Sophos Clean Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-51485912320") Found string "net stop "Sophos Device Control Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-63671392408") Found string "net stop "Sophos File Scanner Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-75876810154") Found string "net stop "Sophos Health Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-88097840784") Found string "net stop "Sophos MCS Agent" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-100343486260") Found string "net stop "Sophos MCS Client" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-112533633088") Found string "net stop "Sophos Message Router" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-124761129430") Found string "net stop "Sophos Safestore Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-136981702168") Found string "net stop "Sophos System Protection Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-149195920858") Found string "net stop "Sophos Web Control Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-161395427382") Found string "net stop "SQLsafe Backup Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-173610163876") Found string "net stop "SQLsafe Filter Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-185813605282") Found string "net stop "Symantec System Recovery" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-198039295536") Found string "net stop "Veeam Backup Catalog Data Service" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-210219831572") Found string "net stop "AcronisAgent" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-222415214620") Found string "net stop "AcrSch2Svc" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-234648809836") Found string "net stop "Antivirus" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-246857198932") Found string "net stop "ARSM" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-259047918206") Found string "net stop "BackupExecAgentAccelerator" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-271271876436") Found string "net stop "BackupExecAgentBrowser" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-283461872658") Found string "net stop "BackupExecDeviceMediaService" /y" (Indicator: "net stop"; Source: "00000000-00005324-00000C46-295647156764")4b:T472,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001984.00000000.180708.0093B000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002128.00000000.180057.0093B000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005324.00000000.173774.01239000.00000002.mdmp")4c:Tf13,Found string "FlsAlloc" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "InitOnceExecuteOnce" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "CreateEventExW" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "CreateSemaphoreW" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "CreateSemaphoreExW" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "CreateThreadpoolTimer" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "CreateThreadpoolWait" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "CreateSymbolicLinkW" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "GetCurrentPackageId" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNEL.APPCORE.DLL) Found string "GetFileInformationByHandleEx" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "SetFileInformationByHandle" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "GetSystemTimePreciseAsFileTime" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "SleepConditionVariableCS" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "SleepConditionVariableSRW" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "CreateThreadpoolWork" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "GetLocaleInfoEx" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "SetThreadGroupAffinity" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "GetThreadGroupAffinity" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL) Found string "GetLogicalProcessorInformationEx" (Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, API is part of module: KERNELBASE.DLL)4d:Td69,Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Acronis VSS Provider" /y" (UID: 00000000-00006280) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Acronis VSS Provider" /y" (UID: 00000000-00007004) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Enterprise Client Service" /y" (UID: 00000000-00008068) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Enterprise Client Service" /y" (UID: 00000000-00007964) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Sophos Agent" /y" (UID: 00000000-00005640) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Sophos Agent" /y" (UID: 00000000-00004436) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Sophos AutoUpdate Service" /y" (UID: 00000000-00002424) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Sophos AutoUpdate Service" /y" (UID: 00000000-00006700) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Sophos Clean Service" /y" (UID: 00000000-00001740) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Sophos Clean Service" /y" (UID: 00000000-00002640) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Sophos Device Control Service" /y" (UID: 00000000-00004660) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Sophos Device Control Service" /y" (UID: 00000000-00005908) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Sophos File Scanner Service" /y" (UID: 00000000-00007972) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Sophos File Scanner Service" /y" (UID: 00000000-00004440) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Sophos Health Service" /y" (UID: 00000000-00007100) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Sophos Health Service" /y" (UID: 00000000-00004136) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Sophos MCS Agent" /y" (UID: 00000000-00007152) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Sophos MCS Agent" /y" (UID: 00000000-00006928) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Sophos MCS Client" /y" (UID: 00000000-00003956) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Sophos MCS Client" /y" (UID: 00000000-00001744) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Sophos Message Router" /y" (UID: 00000000-00005608) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Sophos Message Router" /y" (UID: 00000000-00004656) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Sophos Safestore Service" /y" (UID: 00000000-00001424) Process "%WINDIR%\SysWOW64\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 stop "Sophos Safestore Service" /y" (UID: 00000000-00001316) Process "%WINDIR%\SysWOW64\net.exe" launched with commandline "net stop "Sophos System Protection Service" /y" (UID: 00000000-00003620)4e:T64e,"http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/" (Indicator: ".onion") in Source: 00000000-00005324.00000000.173774.01256000.00000004.mdmp 00000000-00005324.00000001.175695.01256000.00000004.mdmp 00000000-00005324.00000002.177614.01256000.00000004.mdmp 00000000-00005324.00000002.177614.01259000.00000004.mdmp 00000000-00005324.00000003.184632.01256000.00000004.mdmp "http://7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id.onion/" (Indicator: ".onion") in Source: 00000000-00005324.00000000.173774.01256000.00000004.mdmp 00000000-00005324.00000001.175695.01256000.00000004.mdmp 00000000-00005324.00000002.177614.01256000.00000004.mdmp 00000000-00005324.00000002.177614.01259000.00000004.mdmp 00000000-00005324.00000003.184632.01256000.00000004.mdmp "http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/" (Indicator: ".onion") in Source: 00000000-00005324.00000000.173774.01256000.00000004.mdmp 00000000-00005324.00000001.175695.01256000.00000004.mdmp 00000000-00005324.00000002.177614.01256000.00000004.mdmp 00000000-00005324.00000002.177614.01259000.00000004.mdmp 00000000-00005324.00000003.184632.01256000.00000004.mdmp "http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/00b4f860f1798b62b3531f1b4e8bb6e0" (Indicator: ".onion") in Source: 00000000-00005324.00000000.173774.01256000.00000004.mdmp 00000000-00005324.00000001.175695.01256000.00000004.mdmp 00000000-00005324.00000002.177614.01256000.00000004.mdmp 00000000-00005324.00000002.177614.01259000.00000004.mdmp 00000000-00005324.00000003.184632.01256000.00000004.mdmp4f:Tb04,Process "net.exe" with commandline "net stop "Acronis VSS Provider" /y" (Service: "Volume Shadow Copy", UID: 00000000-00006280) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Acronis VSS Provider" /y" (Service: "Volume Shadow Copy", UID: 00000000-00007004) Process "net.exe" with commandline "net stop "Enterprise Client Service" /y" (UID: 00000000-00008068) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Enterprise Client Service" /y" (UID: 00000000-00007964) Process "net.exe" with commandline "net stop "Sophos Agent" /y" (UID: 00000000-00005640) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Sophos Agent" /y" (UID: 00000000-00004436) Process "net.exe" with commandline "net stop "Sophos AutoUpdate Service" /y" (UID: 00000000-00002424) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Sophos AutoUpdate Service" /y" (UID: 00000000-00006700) Process "net.exe" with commandline "net stop "Sophos Clean Service" /y" (UID: 00000000-00001740) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Sophos Clean Service" /y" (UID: 00000000-00002640) Process "net.exe" with commandline "net stop "Sophos Device Control Service" /y" (UID: 00000000-00004660) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Sophos Device Control Service" /y" (UID: 00000000-00005908) Process "net.exe" with commandline "net stop "Sophos File Scanner Service" /y" (UID: 00000000-00007972) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Sophos File Scanner Service" /y" (UID: 00000000-00004440) Process "net.exe" with commandline "net stop "Sophos Health Service" /y" (UID: 00000000-00007100) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Sophos Health Service" /y" (UID: 00000000-00004136) Process "net.exe" with commandline "net stop "Sophos MCS Agent" /y" (UID: 00000000-00007152) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Sophos MCS Agent" /y" (UID: 00000000-00006928) Process "net.exe" with commandline "net stop "Sophos MCS Client" /y" (UID: 00000000-00003956) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Sophos MCS Client" /y" (UID: 00000000-00001744) Process "net.exe" with commandline "net stop "Sophos Message Router" /y" (UID: 00000000-00005608) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Sophos Message Router" /y" (UID: 00000000-00004656) Process "net.exe" with commandline "net stop "Sophos Safestore Service" /y" (UID: 00000000-00001424) Process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop "Sophos Safestore Service" /y" (UID: 00000000-00001316) Process "net.exe" with commandline "net stop "Sophos System Protection Service" /y" (UID: 00000000-00003620)50:T14c4,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005324.00000000.173774.00610000.00000004.mdmp, 00000000-00005324.00000001.175695.00610000.00000004.mdmp, 00000000-00005324.00000002.177614.00610000.00000004.mdmp, 00000000-00005324.00000003.184632.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 61648-4877-004381BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKeyPair\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found api reference \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKeyPair\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2d","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"public key\"; Source: \"00000000-00005324-00000CAD-1685769761\")\n Found string \"-----BEGIN RSA PUBLIC KEY-----\" (Indicator: \"public key\"; Source: \"00000000-00005324.00000002.177614.01259000.00000004.mdmp\")\n Found string \"-----END RSA PUBLIC KEY-----\" (Indicator: \"public key\"; Source: \"00000000-00005324.00000002.177614.01259000.00000004.mdmp\")\n Found string \"-----BEGIN PUBLIC KEY-----\" (Indicator: \"public key\"; Source: \"00000000-00005324.00000002.177614.01259000.00000004.mdmp\")\n Found string \"-----END PUBLIC KEY-----\" (Indicator: \"public key\"; Source: \"00000000-00005324.00000002.177614.01259000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Contains asymmetric cryptographic functions (API string)\n Matched sigs: Possibly contains Public/Private key (encryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match – Encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system firmware table (API string)","description":"file/memory contains long string(File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n file/memory contains long string(Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1592.003","relevance":1,"id":"string-902","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"00000000-00001744.00000000.176801.00911000.00000020.mdmp\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00001744.00000000.176801.00911000.00000020.mdmp\")\n Found string \"EnumServicesStatusExW\" (Source: \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\")\n Found string \"EnumServicesStatusExW\" (Source: \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\"\n Found system information discovery API: \"GetNativeSystemInfo\" in file \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005324.00000000.173774.00610000.00000004.mdmp, 00000000-00005324.00000001.175695.00610000.00000004.mdmp, 00000000-00005324.00000002.177614.00610000.00000004.mdmp, 00000000-00005324.00000003.184632.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\" nul & del %s\" (Indicator: \"cmd /c ping\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found string \"cmd /c ping localhost -n 3 > nul & del %s\" (Indicator: \"/c ping\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found string \"cmd /c ping localhost -n 3 > nul & del %s\" (Indicator: \"cmd /c ping\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")\n Found string \"cmd /c ping localhost -n 3 > nul & del %s\" (Indicator: \"/c ping\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Network Related","name":"Contains Tor project download URL","description":"\"Using TOR Browser(https://www.torproject.org/download/):\" (Indicator: \"using tor browser(https://www.torproject.org/download/):\") in Source: 00000000-00005324.00000000.173774.01256000.00000004.mdmp\n 00000000-00005324.00000001.175695.01256000.00000004.mdmp\n 00000000-00005324.00000002.177614.01256000.00000004.mdmp\n 00000000-00005324.00000002.177614.01259000.00000004.mdmp\n 00000000-00005324.00000003.184632.01256000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-177","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"NetShareGetInfo\" (Indicator: \"NetShareGetInfo\"; Source: \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\")\n Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; Source: \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\")\n Found reference to API \"NetShareGetInfo\" (Indicator: \"NetShareGetInfo\"; Source: \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\")\n Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; Source: \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"]h.zm\"\n Heuristic match: \"m;.exe;.bat;.cm\"\n Heuristic match: \"=.com;.exe;.bat;.cm\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Pattern match: \"https://www.torproject.org/download/\"\n Pattern match: \"http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/\"\n Pattern match: \"http://7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id.onion/\"\n Pattern match: \"http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/\"\n Pattern match: \"http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/00b4f860f1798b62b3531f1b4e8bb6e0\"\n Pattern match: \"https://utox.org/utox_win64.exe\"\n Heuristic match: \"osoft.windows.ds.net\"\n Heuristic match: \"exe;.bat;.cm\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00005324\"\n YARA signature for encryption algorithm file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\")\n Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\")\n Found reference to API \"75876064092,6248,3024,,RtlGetVersion,NTDLL.dll,\"00:45:42.203\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005324.00000001.175695.00610000.00000004.mdmp\")\n Found reference to API \"149195120632,6248,3024,,RtlGetVersion,NTDLL.dll,\"00:46:12.750\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005324.00000002.177614.00610000.00000004.mdmp\")\n Found reference to API \"388403043426,6248,3024,,RtlGetVersion,NTDLL.dll,\"00:47:52.421\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005324.00000003.184632.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyW\" in file \"00000000-00001744.00000000.176801.00911000.00000020.mdmp\"\n Found registry query API: \"RegOpenKeyW\" in \"00000000-00001744.00000000.176801.00911000.00000020.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve name of the domain controller for the current domain (API string)","description":"Found domain controller discovery API reference: \"DsGetDcName\" in \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\"\n Found domain controller discovery API reference: \"DsGetDcName\" in \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-904","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" nul & del %s\" (Indicator: \"ping\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found string \"cmd /c ping localhost -n 3 > nul & del %s\" (Indicator: \"ping\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\")\n Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete users from a group (API string)","description":"Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDelUser\"; Source: \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\")\n Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\")\n Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\")\n Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDelUser\"; Source: \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\")\n Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\")\n Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-218","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\")\n Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$48","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00003976.00000000.179731.03320000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-522","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001984.00000000.180708.0093B000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002128.00000000.180057.0093B000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005324.00000000.173774.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"Found string \"Antivirus\" (Indicator: \"antivir\"; Source: \"00000000-00005324.00000002.177614.01259000.00000004.mdmp\")\n Found string \"McAfeeEngineService\" (Indicator: \"mcafee\"; Source: \"00000000-00005324.00000002.177614.01259000.00000004.mdmp\")\n Found string \"McAfeeFramework\" (Indicator: \"mcafee\"; Source: \"00000000-00005324.00000002.177614.01259000.00000004.mdmp\")\n Found string \"McAfeeFrameworkMcAfeeFramework\" (Indicator: \"mcafee\"; Source: \"00000000-00005324.00000002.177614.01259000.00000004.mdmp\")\n Found string \"McShield\" (Indicator: \"mcshield\"; Source: \"00000000-00005324.00000002.177614.01259000.00000004.mdmp\")\n Found string \"SmcService\" (Indicator: \"smcservice\"; Source: \"00000000-00005324.00000002.177614.01259000.00000004.mdmp\")\n Found string \"ANTIVIRUS\" (Indicator: \"antivir\"; Source: \"00000000-00007748.00000000.180382.00710000.00000004.mdmp\")\n Found string \"Antivirus\" (Indicator: \"antivir\"; Source: \"00000000-00007748.00000000.180382.00710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69a092d95dab8f7c8909c7b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"