24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 16fe4de22358… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 16fe4de22358…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 11 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/16fe4de2235850a7d947e4517a667a9bfcca3aee17b5022b02c68cc584aa6548","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","16fe4de2235850a7d947e4517a667a9bfcca3aee17b5022b02c68cc584aa6548"],"about":{"@type":"SoftwareApplication","name":"7zg.exe","applicationCategory":["peexe","executable"],"identifier":"16fe4de2235850a7d947e4517a667a9bfcca3aee17b5022b02c68cc584aa6548","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6b2,Spawned process "cmd.exe" with commandline "/C taskkill /f /t /im taskslist.exe" (UID: 00019993-00002576) Spawned process "taskkill.exe" with commandline "taskkill /f /t /im taskslist.exe" (UID: 00020007-00003552) Spawned process "cmd.exe" with commandline "/C taskkill /f /t /im sqlmon.exe" (UID: 00020008-00003632) Spawned process "cmd.exe" with commandline "/C taskkill /f /t /im taskslist.exe" (UID: 00020030-00003604) Spawned process "taskkill.exe" with commandline "taskkill /f /t /im sqlmon.exe" (UID: 00020031-00001188) Spawned process "cmd.exe" with commandline "/C wmic Path win32_process Where "ExecutablePath Like '%Startup\\%'" Call Terminate" (UID: 00020059-00003536) Spawned process "taskkill.exe" with commandline "taskkill /f /t /im taskslist.exe" (UID: 00020064-00002344) Spawned process "WMIC.exe" with commandline "wmic Path win32_process Where "ExecutablePath Like '%Startup\\%'" Call Terminate" (UID: 00020078-00002988) Spawned process "cmd.exe" with commandline "/C del /F "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe"" (UID: 00020569-00002564) Spawned process "taskslist.exe" (UID: 00021373-00003580) Spawned process "cmd.exe" with commandline "/C wmic Path win32_process Where "ExecutablePath Like '%Temp\\%'" Call Terminate" (UID: 00024143-00002900) Spawned process "cmd.exe" with commandline "/V:ON /C dir /S/B/A-D "%APPDATA%\Mozilla\prefs.js" > "%TEMP%azi" && SETLOCAL EnableDelayedExpansion && set /p v=<"%TEMP%azi" && echo ^user_pref("devtools.selfxss.count", 100); >> "!v!"" (UID: 00024159-00002544) Spawned process "WMIC.exe" with commandline "wmic Path win32_process Where "ExecutablePath Like '%Temp\\%'" Call Terminate" (UID: 00024160-00002360)26:T430,"" touched file "C:\Windows\System32\oleaccrc.dll" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\4pGzNbo\AppData\Roaming\Microsoft\Windows\Start Menu" "" touched file "C:\Users\4pGzNbo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs" "" touched file "C:\Users\4pGzNbo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" "" touched file "C:\Windows\System32" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Users\4pGzNbo\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "C:\Windows\System32\cmd.exe"27:T41b,"" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskslist.exe" (Handle: 572) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskslist.exe" (Handle: 572) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskslist.exe" (Handle: 572) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84)28:T54f,Found malicious artifacts related to "46.30.213.31": ... URL: http://renouvellementservice.com/ (AV positives: 4/67 scanned on 05/25/2018 18:47:28) URL: https://renouvellementservice.com/ (AV positives: 4/67 scanned on 05/25/2018 18:47:26) URL: http://www.rohacafe.com/wp-content/themes/pofig.exe (AV positives: 5/67 scanned on 05/25/2018 16:46:43) URL: https://netflix-oppdater-betalingsinformasjon.1711839106.com/netflix-oppdater-betalingsinformasjon/ (AV positives: 3/68 scanned on 05/25/2018 13:25:36) URL: http://www.skyspotting.net/ (AV positives: 1/67 scanned on 05/25/2018 07:26:16) File SHA256: 910e0bd4979a0bcb02cdbbb8a52e92cd5f837a102c48aba159269a4ef69d6269 (AV positives: 1/57 scanned on 05/24/2018 13:38:06) File SHA256: fdf0db0e842324f5fa5f22ed2ea5ffa4462c9ee75564a74c5ede8565792e00ab (AV positives: 18/60 scanned on 05/24/2018 13:02:24) File SHA256: 5b08fee440988165829e42536f063cad1db982296e1142e6ebe1ec18aaade048 (AV positives: 2/60 scanned on 05/24/2018 13:02:20) File SHA256: a1807b21dfb619bf5327d99f721da85066964ad54515f1ed0d9cd11e8c0d5141 (AV positives: 44/66 scanned on 05/24/2018 08:44:46) File SHA256: 72ec27bd0d959a1e6713d96b4e55c5a9b92ac6d1b5b5a4a8d5d1211422fcee57 (AV positives: 1/59 scanned on 05/10/2018 13:09:22) File SHA256: ba529c8b0c0a8f88e0d7a672355c2704a6c7032dc4cc49a9823492897763caf1 (Date: 01/20/2018 05:45:50)29:T6ed,Spawned process "" (UID: 00017341-00004072) Spawned process "cmd.exe" with commandline "/C taskkill /f /t /im taskslist.exe" (UID: 00019993-00002576) Spawned process "taskkill.exe" with commandline "taskkill /f /t /im taskslist.exe" (UID: 00020007-00003552) Spawned process "cmd.exe" with commandline "/C taskkill /f /t /im sqlmon.exe" (UID: 00020008-00003632) Spawned process "cmd.exe" with commandline "/C taskkill /f /t /im taskslist.exe" (UID: 00020030-00003604) Spawned process "taskkill.exe" with commandline "taskkill /f /t /im sqlmon.exe" (UID: 00020031-00001188) Spawned process "cmd.exe" with commandline "/C wmic Path win32_process Where "ExecutablePath Like '%Startup\\%'" Call Terminate" (UID: 00020059-00003536) Spawned process "taskkill.exe" with commandline "taskkill /f /t /im taskslist.exe" (UID: 00020064-00002344) Spawned process "WMIC.exe" with commandline "wmic Path win32_process Where "ExecutablePath Like '%Startup\\%'" Call Terminate" (UID: 00020078-00002988) Spawned process "cmd.exe" with commandline "/C del /F "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe"" (UID: 00020569-00002564) Spawned process "taskslist.exe" (UID: 00021373-00003580) Spawned process "cmd.exe" with commandline "/C wmic Path win32_process Where "ExecutablePath Like '%Temp\\%'" Call Terminate" (UID: 00024143-00002900) Spawned process "cmd.exe" with commandline "/V:ON /C dir /S/B/A-D "%APPDATA%\Mozilla\prefs.js" > "%TEMP%azi" && SETLOCAL EnableDelayedExpansion && set /p v=<"%TEMP%azi" && echo ^user_pref("devtools.selfxss.count", 100); >> "!v!"" (UID: 00024159-00002544) Spawned process "WMIC.exe" with commandline "wmic Path win32_process Where "ExecutablePath Like '%Temp\\%'" Call Terminate" (UID: 00024160-00002360)2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//////////////////8AAP//////////////////AAD//////////////////wAA//AAAAAAAAD/AAAAD/8AAP/wAAAAAAAA/wAAAA//AAD/8AAA//AAAP8AD////wAA//AAAP/wAAD/AA////8AAP/wAAD/8AAA//AA////AAD/8AAA//AAAP//AA///wAA//AAAP/wAAD///AA//8AAP/wAAAP/wAA////AA//AAD/8AAAAP/wAP8AAAAP/wAA//AAAAAP/wD/AAAAD/8AAP/wD/////8A////////AAD/8A//////AP///////wAA//AAAAAAAAD///////8AAP/wAAAAAAAA////////AAD/8AAAAAAAAP///////wAA//////////////////8AAP//////////////////AAD//////////////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"16fe4de2235850a7d947e4517a667a9bfcca3aee17b5022b02c68cc584aa6548","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791494336636,"unified_at":"2026-10-08T21:18:56.636Z","metadata":{"hashes":{"sha256":"16fe4de2235850a7d947e4517a667a9bfcca3aee17b5022b02c68cc584aa6548","sha1":"2dc9760a7c6e9d261c73efb7b2604840734bc058","md5":"b2076cda88f44eacc95b21a741b9a759","sha512":"69bcaf44fcc1b6920dd7249d32669ba1f667c1c1cfc174fe0756d58da3f99e456c90b716658d5fce80f4348412462e50cdd9e1ca2fba70d66e490cd6480693e7","ssdeep":"3072:/NJ2UI+OcOt9cSQMBue5UZwl9j231rb1niHUp3nyxXVQZNih3WtPT76YXG8s4r/D:r2UIpMSUmfA9Bi0tyA6S28Jr/Kqntq","ssdeep_chunks":["3072:/NJ2UI+","3072:NJ2UI+O","3072:J2UI+Oc","3072:2UI+OcO","3072:UI+OcOt","3072:I+OcOt9","3072:+OcOt9c","3072:OcOt9cS","3072:cOt9cSQ","3072:Ot9cSQM","3072:t9cSQMB","3072:9cSQMBu","3072:cSQMBue","3072:SQMBue5","3072:QMBue5U","3072:MBue5UZ","3072:Bue5UZw","3072:ue5UZwl","3072:e5UZwl9","3072:5UZwl9j","3072:UZwl9j2","3072:Zwl9j23","3072:wl9j231","3072:l9j231r","3072:9j231rb","3072:j231rb1","3072:231rb1n","3072:31rb1ni","3072:1rb1niH","3072:rb1niHU","3072:b1niHUp","3072:1niHUp3","3072:niHUp3n","3072:iHUp3ny","3072:HUp3nyx","3072:Up3nyxX","3072:p3nyxXV","3072:3nyxXVQ","3072:nyxXVQZ","3072:yxXVQZN","3072:xXVQZNi","3072:XVQZNih","3072:VQZNih3","3072:QZNih3W","3072:ZNih3Wt","3072:Nih3WtP","3072:ih3WtPT","3072:h3WtPT7","3072:3WtPT76","3072:WtPT76Y","3072:tPT76YX","3072:PT76YXG","3072:T76YXG8","3072:76YXG8s","3072:6YXG8s4","3072:YXG8s4r","3072:XG8s4r/","3072:G8s4r/D","6144:/NJ2UI+","6144:NJ2UI+O","6144:J2UI+Oc","6144:2UI+OcO","6144:UI+OcOt","6144:I+OcOt9","6144:+OcOt9c","6144:OcOt9cS","6144:cOt9cSQ","6144:Ot9cSQM","6144:t9cSQMB","6144:9cSQMBu","6144:cSQMBue","6144:SQMBue5","6144:QMBue5U","6144:MBue5UZ","6144:Bue5UZw","6144:ue5UZwl","6144:e5UZwl9","6144:5UZwl9j","6144:UZwl9j2","6144:Zwl9j23","6144:wl9j231","6144:l9j231r","6144:9j231rb","6144:j231rb1","6144:231rb1n","6144:31rb1ni","6144:1rb1niH","6144:rb1niHU","6144:b1niHUp","6144:1niHUp3","6144:niHUp3n","6144:iHUp3ny","6144:HUp3nyx","6144:Up3nyxX","6144:p3nyxXV","6144:3nyxXVQ","6144:nyxXVQZ","6144:yxXVQZN","6144:xXVQZNi","6144:XVQZNih","6144:VQZNih3","6144:QZNih3W","6144:ZNih3Wt","6144:Nih3WtP","6144:ih3WtPT","6144:h3WtPT7","6144:3WtPT76","6144:WtPT76Y","6144:tPT76YX","6144:PT76YXG","6144:T76YXG8","6144:76YXG8s","6144:6YXG8s4","6144:YXG8s4r","6144:XG8s4r/","6144:G8s4r/D","3072:r2UIpMS","3072:2UIpMSU","3072:UIpMSUm","3072:IpMSUmf","3072:pMSUmfA","3072:MSUmfA9","3072:SUmfA9B","3072:UmfA9Bi","3072:mfA9Bi0","3072:fA9Bi0t","3072:A9Bi0ty","3072:9Bi0tyA","3072:Bi0tyA6","3072:i0tyA6S","3072:0tyA6S2","3072:tyA6S28","3072:yA6S28J","3072:A6S28Jr","3072:6S28Jr/","3072:S28Jr/K","3072:28Jr/Kq","3072:8Jr/Kqn","3072:Jr/Kqnt","3072:r/Kqntq"],"imphash":"1abce8fd0c90a1bd9aae86bc6200406a"},"file_info":{"file_name":"7zg.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":365056,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1527258352000,"last_seen":1664738041000,"last_multi_scan":1664738041000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banker","clipbanker","tinba","tinbanker","tinybanker"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":21,"suspicious_count":16,"malicious_count":11,"total":48},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.BackSwap","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.ClipBanker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Swrort.teemf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.40200366","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.40200366 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/BackSwap.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Banker.Backswap","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0052aadc1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-BackSwap.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Swrort-AY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_BT.BED6D6D4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_BT.BED6D6D4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.BackSwap","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 2037-1549-00408B3E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00017341-00004072-7747-845-00408B3E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00021373-00003580-23467-845-00408B3E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.dll at 2037-894-00407B0C\n GetDiskFreeSpaceW@KERNEL32.DLL at 00017341-00004072-7747-192-00407B0C\n GetDiskFreeSpaceW@KERNEL32.DLL at 00021373-00003580-23467-192-00407B0C","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT * FROM win32_process WHERE ExecutablePath Like '%Startup\\\\%'\"\n \"WMIC.exe\" issued a query \"SELECT * FROM win32_process WHERE ExecutablePath Like '%Temp\\\\%'\"","origin":"API Call","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"WMIC.exe\" issued a query \"SELECT * FROM win32_process WHERE ExecutablePath Like '%Startup\\\\%'\"\n \"WMIC.exe\" issued a query \"SELECT * FROM win32_process WHERE ExecutablePath Like '%Temp\\\\%'\"","origin":"API Call","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"taskslist.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"taskslist.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"efg-uebach-palenberg.de\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"46.30.213.31:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"WMIC.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"taskslist.exe\" created file \"%TEMP%\\niko.log\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C taskkill /f /t /im taskslist.exe\" on 2018-5-25.22:04:45.069\n \"/C taskkill /f /t /im sqlmon.exe\" on 2018-5-25.22:04:45.239\n \"/C taskkill /f /t /im taskslist.exe\" on 2018-5-25.22:04:45.459\n \"/C wmic Path win32_process Where \"ExecutablePath Like '%Startup\\\\%'\" Call Terminate\" on 2018-5-25.22:04:45.750\n \"/C del /F \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.exe\"\" on 2018-5-25.22:06:10.847\n \"/C wmic Path win32_process Where \"ExecutablePath Like '%Temp\\\\%'\" Call Terminate\" on 2018-5-25.22:07:26.629\n \"/V:ON /C dir /S/B/A-D \"%APPDATA%\\Mozilla\\prefs.js\" > \"%TEMP%azi\" && SETLOCAL EnableDelayedExpansion && set /p v=<\"%TEMP%azi\" && echo ^user_pref(\"devtools.selfxss.count\", 100); >> \"!v!\"\" on 2018-5-25.22:07:26.809","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$25","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"\n \"taskslist.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"niko.log\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"_Xefg-uebach-palenberg.de\"\n Pattern match: \"ipko.pl/secure/ikd3/index.html#home\"\n Pattern match: \"24.pl/centrum24-web/ThirdPartyTransfer\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"efg-uebach-palenberg.de\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"root\\cimv2\" (Indicator: \"root\\cimv2\")\n \"WMIC.exe\" (Indicator: \"wmic.exe\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"taskslist.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"taskkill.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"\n \"taskslist.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"taskkill.exe\" wrote bytes \"4053087758580977186a0977653c0a770000000000bfe4760000000056cce476000000007ccae47600000000376842756a2c0a77d62d0a7700000000206942750000000029a6e47600000000a48d427500000000f70ee47600000000\" to virtual address \"0x771A1000\" (part of module \"NSI.DLL\")\n \"WMIC.exe\" wrote bytes \"4053087758580977186a0977653c0a770000000000bfe4760000000056cce476000000007ccae47600000000376842756a2c0a77d62d0a7700000000206942750000000029a6e47600000000a48d427500000000f70ee47600000000\" to virtual address \"0x771A1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7zg.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"WMIC.exe\" at 00020078-00002988-00000105-64233693501\n \"taskslist.exe\" at 00021373-00003580-00000105-157439501171\n \"WMIC.exe\" at 00024160-00002360-00000105-158722830592","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"taskslist.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"/C wmic Path win32_process Where \"ExecutablePath Like '%Startup\\\\%'\" Call Terminate\" (Indicator: \"win32_process\"; File: \"7zg.exe.bin\")\n \"/C wmic Path win32_process Where \"ExecutablePath Like '%Temp\\\\%'\" Call Terminate\" (Indicator: \"win32_process\"; File: \"7zg.exe.bin\")\n \"wmic Path win32_process Where \"ExecutablePath Like '%Startup\\\\%'\" Call Terminate\" (Indicator: \"win32_process\"; File: \"WMIC.exe\")\n \"wmic Path win32_process Where \"ExecutablePath Like '%Temp\\\\%'\" Call Terminate\" (Indicator: \"win32_process\"; File: \"WMIC.exe\")","origin":"File/Memory","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"Environment Awareness","name":"Gets WMI data known to be used for VM detection via WMIC","description":"Process \"WMIC.exe\" with commandline \"wmic Path win32_process Where \"ExecutablePath Like '%Startup\\\\%'\" Call Terminate\" (UID: 00020078-00002988)\n Process \"WMIC.exe\" with commandline \"wmic Path win32_process Where \"ExecutablePath Like '%Temp\\\\%'\" Call Terminate\" (UID: 00024160-00002360)","origin":"Monitored Target","relevance":10,"id":"target-50","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"taskslist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"taskslist.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"taskslist.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"taskslist.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"taskslist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"WMIC.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"WMIC.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"taskslist.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\taskslist.exe\" marked \"%TEMP%\\niko.log\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\taskslist.exe\" with delete access\n \"taskslist.exe\" opened \"C:\\Users\\4pGzNbo\\AppData\\Local\\Temp\\niko.log\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"taskslist.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"taskslist.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"taskslist.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"taskslist.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"taskslist.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"taskslist.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegEnumKeyExW\n RegOpenKeyExW\n RegDeleteKeyW\n RegOpenKeyExA\n DeviceIoControl\n GetModuleFileNameW\n GetVersionExW\n GetFileAttributesW\n LoadLibraryA\n GetCommandLineW\n LoadLibraryExW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n MapViewOfFile\n WriteFile\n LoadLibraryW\n GetModuleHandleA\n FindNextFileW\n GetTempPathW\n GetStartupInfoA\n FindFirstFileW\n OpenFileMappingW\n GetModuleHandleW\n GetDriveTypeW\n CreateFileW\n Sleep\n GetTickCount\n VirtualAlloc\n GetFileSize","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"CreateHardLinkW\" (Source: 7zg.exe.bin, API is part of module: KERNEL32.DLL)\n Found string \"FindNextStreamW\" (Source: 7zg.exe.bin, API is part of module: KERNEL32.DLL)\n Found string \"FindFirstStreamW\" (Source: 7zg.exe.bin, API is part of module: KERNEL32.DLL)\n Found string \"GetDiskFreeSpaceExW\" (Source: 7zg.exe.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GlobalMemoryStatusEx\" (Source: 7zg.exe.bin, API is part of module: KERNELBASE.DLL)\n Found string \"DllGetVersion\" (Source: 7zg.exe.bin, API is part of module: IEFRAME.DLL)\n Found string \"GetLargePageMinimum\" (Source: 7zg.exe.bin, API is part of module: KERNEL32.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\taskslist.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /f /t /im taskslist.exe\" (UID: 00020007-00003552)\n Process \"taskkill.exe\" with commandline \"taskkill /f /t /im sqlmon.exe\" (UID: 00020031-00001188)\n Process \"taskkill.exe\" with commandline \"taskkill /f /t /im taskslist.exe\" (UID: 00020064-00002344)","origin":"Monitored Target","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"7zg.exe.bin\" (Offset: 273928)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"37/66 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"37/66 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 2037-1064-00406B5C\n DeviceIoControl@KERNEL32.dll at 2037-1799-00406C2C\n DeviceIoControl@KERNEL32.DLL at 00017341-00004072-7747-360-00406B5C\n DeviceIoControl@KERNEL32.DLL at 00017341-00004072-7747-1098-00406C2C\n DeviceIoControl@KERNEL32.DLL at 00021373-00003580-23467-360-00406B5C\n DeviceIoControl@KERNEL32.DLL at 00021373-00003580-23467-1098-00406C2C","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"37/66 Antivirus vendors marked spawned process \"taskslist.exe\" (PID: 3580) as malicious (classified as \"Trojan.Generic\" with 56% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\"\n \"\" allocated memory in \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" allocated memory in \"C:\\7zg.exe\"\n \"taskslist.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$27","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$28","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$29","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"},{"detail":"Gets WMI data known to be used for VM detection via WMIC"}],"sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]}]},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":94,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":45,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["banker","clipbanker","tinba","tinbanker","tinybanker"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5b081cef7ca3e178f9408376","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["DNK"],"submit_name":"7zg.exe","analysis_start_time":"2018-05-25T22:02:23+00:00","indicators_count":{"informative":21,"suspicious":21,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"46.30.213.31","port":443,"protocol":"TCP","country":"Denmark","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]}],"dns_resolutions":[{"domain":"efg-uebach-palenberg.de","address":"46.30.213.31","ttl":3202,"country":"Denmark","registrar_organization":"One.com A/S","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}],"processes":[{"pid":4072,"ppid":0,"name":"7zg.exe","command_line":"","sha256":"16fe4de2235850a7d947e4517a667a9bfcca3aee17b5022b02c68cc584aa6548","normalized_path":"C:\\7zg.exe","uid":"00017341-00004072","icon":"$2a"},{"pid":2576,"ppid":4072,"name":"cmd.exe","command_line":"/C taskkill /f /t /im taskslist.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017341-00004072","uid":"00019993-00002576"},{"pid":3552,"ppid":2576,"name":"taskkill.exe","command_line":"taskkill /f /t /im taskslist.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00019993-00002576","uid":"00020007-00003552"},{"pid":3632,"ppid":4072,"name":"cmd.exe","command_line":"/C taskkill /f /t /im sqlmon.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017341-00004072","uid":"00020008-00003632"},{"pid":1188,"ppid":3632,"name":"taskkill.exe","command_line":"taskkill /f /t /im sqlmon.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00020008-00003632","uid":"00020031-00001188"},{"pid":3604,"ppid":4072,"name":"cmd.exe","command_line":"/C taskkill /f /t /im taskslist.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017341-00004072","uid":"00020030-00003604"},{"pid":2344,"ppid":3604,"name":"taskkill.exe","command_line":"taskkill /f /t /im taskslist.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00020030-00003604","uid":"00020064-00002344"},{"pid":3536,"ppid":4072,"name":"cmd.exe","command_line":"/C wmic Path win32_process Where \"ExecutablePath Like '%Startup\\\\%'\" Call Terminate","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017341-00004072","uid":"00020059-00003536"},{"pid":2988,"ppid":3536,"name":"WMIC.exe","command_line":"wmic Path win32_process Where \"ExecutablePath Like '%Startup\\\\%'\" Call Terminate","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00020059-00003536","uid":"00020078-00002988"},{"pid":2564,"ppid":4072,"name":"cmd.exe","command_line":"/C del /F \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017341-00004072","uid":"00020569-00002564"},{"pid":3580,"ppid":4072,"name":"taskslist.exe","command_line":"","sha256":"16fe4de2235850a7d947e4517a667a9bfcca3aee17b5022b02c68cc584aa6548","normalized_path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\taskslist.exe","parent_uid":"00017341-00004072","uid":"00021373-00003580"},{"pid":2900,"ppid":3580,"name":"cmd.exe","command_line":"/C wmic Path win32_process Where \"ExecutablePath Like '%Temp\\\\%'\" Call Terminate","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00021373-00003580","uid":"00024143-00002900"},{"pid":2360,"ppid":2900,"name":"WMIC.exe","command_line":"wmic Path win32_process Where \"ExecutablePath Like '%Temp\\\\%'\" Call Terminate","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00024143-00002900","uid":"00024160-00002360"},{"pid":2544,"ppid":3580,"name":"cmd.exe","command_line":"/V:ON /C dir /S/B/A-D \"%APPDATA%\\Mozilla\\prefs.js\" > \"%TEMP%azi\" && SETLOCAL EnableDelayedExpansion && set /p v=<\"%TEMP%azi\" && echo ^user_pref(\"devtools.selfxss.count\", 100); >> \"!v!\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00021373-00003580","uid":"00024159-00002544"}],"all_imported_dlls":["user32.dll","winbrand.dll","nsi.dll","RpcRtRemote.dll","schannel.dll","dbghelp.dll","KernelBase.dll","msasn1.dll","devobj.dll","oleacc.dll","MSO.DLL","wship6.dll","comctl32.dll","shell32.dll","sechost.dll","msctf.dll","psapi.dll","srvcli.dll","dnsapi.dll","MSOXMLMF.DLL","urlmon.dll","iertutil.dll","cryptbase.dll","uxtheme.dll","mpr.dll","winsta.dll","fastprox.dll","sxs.dll","wbemcomn.dll","WSHTCPIP.DLL","FWPUCLNT.DLL","credssp.dll","ntdll.dll","rpcrt4.dll","IPHLPAPI.DLL","userenv.dll","mswsock.dll","clbcatq.dll","secur32.dll","msxml3.dll","gdi32.dll","shlwapi.dll","ieframe.dll","sspicli.dll","oleaut32.dll","kernel32.dll","msvcrt.dll","profapi.dll","setupapi.dll","winnsi.dll","netprofm.dll","imm32.dll","wininet.dll","apphelp.dll","framedynos.dll","netapi32.dll","msxml3r.dll","msvcr90.dll","ieproxy.dll","lpk.dll","usp10.dll","oleaccrc.dll","cfgmgr32.dll","netutils.dll","cryptsp.dll","rsaenh.dll","rasapi32.dll","ntmarta.dll","wintrust.dll","SensApi.dll","winrnr.dll","dhcpcsvc.dll","dhcpcsvc6.dll","rpcss.dll","version.dll","wkscli.dll","ntdsapi.dll","rasman.dll","nlaapi.dll","pnrpnsp.dll","npmproxy.dll","ole32.dll","advapi32.dll","propsys.dll","ws2_32.dll","wtsapi32.dll","wbemprox.dll","rtutils.dll","rasadhlp.dll","comdlg32.dll","crypt32.dll","Wldap32.dll","wbemsvc.dll","NapiNSP.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"niko.log","sha256":"9a65f07e176b254df939744dfd5c83332a788e80fb01550bdbc60be5d0e16019","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"C:\\7zg.exe","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\taskslist.exe","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"C:\\7zg.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\taskslist.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%TEMP%\\niko.log","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!4pgznbo!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!4pgznbo!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!4pgznbo!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\c:!users!4pgznbo!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\c:!users!4pgznbo!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\c:!users!4pgznbo!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\c:!users!4pgznbo!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!4pgznbo!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5b081cef7ca3e178f9408376"}]}]}},"report_ids":{"sandbox_job_ids":["5b081cef7ca3e178f9408376"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 16fe4de22358… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 16fe4de22358…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 11 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/16fe4de2235850a7d947e4517a667a9bfcca3aee17b5022b02c68cc584aa6548"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 16fe4de22358… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 16fe4de22358…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 11 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/16fe4de2235850a7d947e4517a667a9bfcca3aee17b5022b02c68cc584aa6548"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 16fe4de22358… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 16fe4de22358…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 11 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]