24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Exploit.BypassUAC Sample 328b48cd133b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 328b48cd133b…. Malware family: Exploit.BypassUAC. Threat score 100/100. 13/29 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516","keywords":["Malicious","Exploit.BypassUAC","malware analysis","sandbox report","threat intelligence","328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Exploit.BypassUAC","antivirusDetections":{"malicious":13,"total":29},"behavioralIndicators":{"malicious":7,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T714,Pattern match: "http://schemas.openxmlformats.org/drawingml/2006/main" Heuristic match: "support@xero.com" Heuristic match: "mailto:support@xero.com" Pattern match: "http://dmd.metaservices.microsoft.com/dms/metadata.svc" Pattern match: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?86e51f731334ceab HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s2.symcb.com" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBuN56dlW1Lzehhu%2FtdSD3U%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcd.com" Pattern match: "http://www.symauth.com/cps0*" Heuristic match: "GET /CRL/Omniroot2025.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cdp1.public-trust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAt%2BEJA8OEkP%2Bi9nmoehp7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSLIycRsoI3J6zPns4K1aQgAqaqHgQUZ50PIAkMzIo65YJGcmL88cyQ5UACEAG2Yem3HYLmNssdMr3TCFk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"26:T417,"%PROGRAMFILES%\MICROS~2\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tst7F7E.tmp" for deletion "%PROGRAMFILES%\MICROS~2\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tst800B.tmp" for deletion "%PROGRAMFILES%\MICROS~2\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tst8099.tmp" for deletion "%PROGRAMFILES%\MICROS~2\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tst8107.tmp" for deletion "%PROGRAMFILES%\MICROS~2\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tst82ED.tmp" for deletion "%PROGRAMFILES%\MICROS~2\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tst836B.tmp" for deletion "%PROGRAMFILES%\MICROS~2\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0001.doc" for deletion "%WINDIR%\SysWOW64\wusa.exe" marked "C:\Windows\SysWOW64\$dpx$.tmp" for deletion "%WINDIR%\SysWOW64\wusa.exe" marked "C:\8c195f85b9ee63f42f77690d54" for deletion27:T673,"WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000401") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000402") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000403") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000404") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000405") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000406") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000407") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000408") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040A") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040B") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040C") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040D") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040E") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040F") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000410") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000411") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000412") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000413")28:T92e,"" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "WINWORD.EXE" wrote bytes "e9abc04a00cc" to virtual address "0xFD784060" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "0000000000000000" to virtual address "0xF319C128" (part of module "MSCONV97.DLL") "WINWORD.EXE" wrote bytes "e913b0e9ff" to virtual address "0xFDD950C0" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "6173744572726f72" to virtual address "0xF3197AA8" (part of module "MSCONV97.DLL") "WINWORD.EXE" wrote bytes "737bb0431ab4d301" to virtual address "0x3F2D3258" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "e9eef5fb1ab4d301" to virtual address "0xED9971C0" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "b3407f331bb4d301" to virtual address "0xE481DE48" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "723febfb1ab4d301" to virtual address "0xEC6CFA00" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "0000000000000000" to virtual address "0xF319CC30" (part of module "MSCONV97.DLL") "WINWORD.EXE" wrote bytes "e94b9f4a00cccccccccc" to virtual address "0xFD786230" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "48b8bc5206e9fe070000ffe0" to virtual address "0x77329020" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "e933ef4a00cccc" to virtual address "0xFD781210" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e933f04a00" to virtual address "0xFD781180" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "3cf3a1d71ab4d301" to virtual address "0xF2BC0160" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "4b1c44a320b4d301" to virtual address "0xF39625D8" (part of module "MSPROOF7.DLL") "WINWORD.EXE" wrote bytes "32e3f7fb1ab4d301" to virtual address "0xEB722350" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "68bb33f81ab4d301" to virtual address "0xEA47D610" (part of module "MSO.DLL") "cmd.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "wusa.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL")29:T4e1,Found malicious artifacts related to "172.217.22.78": ...File SHA256: fdf8b44ea0a895e39ffdb24bce854e5ee427a8d7c076335702f29543941461e0 (Date: 02/19/2018 20:51:27) File SHA256: 82f48afe933cc7cede1b4cf0bd7fd28dbbedb1fc19b079619d2eaeec2f55dc72 (Date: 02/19/2018 20:43:40) File SHA256: 207e4e68d379bedd5bbac8d92812608791af9727dce3ddf75178594ba3a1efe5 (Date: 02/18/2018 14:03:22) File SHA256: 6a880757512671123d1bedfec79f9ca983fdee5f1ec88c80e82dd1c599ccd8e3 (Date: 02/18/2018 13:55:19) File SHA256: fe81a9a7b34af944c9a8df7bbacc85c9ed78ac82cf26a11c95d897b6e0307acb (Date: 02/18/2018 03:36:18) File SHA256: 516bb357c67c9ec53d2809c04be883d0cd33072345ef84a44445872d60821dd6 (AV positives: 31/67 scanned on 02/02/2018 12:04:35) File SHA256: 431461a0b3e35000f24240c866eaf5b77738e80527dc928c1d49e098131e8907 (AV positives: 14/54 scanned on 02/02/2018 12:03:25) File SHA256: 281ac9cacbc0f56dbcb95fa6e67280196b74d75055d227415e499edbdc29e7b9 (AV positives: 51/67 scanned on 02/01/2018 16:57:31) File SHA256: f170ab7210308dc9da43a98f56b7b484ea0b8d56feddbf457cf66432c6dc41ba (AV positives: 50/66 scanned on 01/27/2018 21:46:16) File SHA256: 8aecb817ad1aa2f1b44bbdd33e7c9a73b5bd5cf89983bc2d5a514fc6fa3839df (AV positives: 1/64 scanned on 01/26/2018 13:42:29)2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////////////8AAAAAAA//////////////AAAAAABIiId3b////////wAAAGZmZmZmZm93d3d3d/8AAABmZmZmZmZv////////AAAAZmZmZmZmb////////wAAAGZmZmZmZm93d3d3d/8AAABmaIdoh2Zv////////AAAAZm/4aPhmb////////wAAAGZv/2//Zm93d3d3d/8AAABmf/9//3Zv////////AAAAZo9//492b////////wAAAGaPb/9vhm93d3d3d/8AAABm/2j4b/Zv////////AAAAZ/ho+Gj2b////////wAAAGZmZmZmZm93d3d3d/8AAABmZmZmZmZv////////AAAAZmZmZmZmb////////wAAAGZmZmZmZm93d3d3d/8AAAAAAA/4iHdv////////AAAAAAAP/////////////wAAAAAAD/d3d3d3d3d3d4gAAAAAAA/////////4///wAAAAAAAP////////+P//AAAAAAAAD/d3d3d3d3f/8AAAAAAAAA/////////4/wAAAAAAAAAP////////+PAAAAAAAAAAD/////////gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////wAAB/8AAAf+AAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH8AAAB/8AAAf/AAAH/wAAB/8AAA//AAAf/wAAP/8AAH//AAD//wAB////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791558745873,"unified_at":"2026-10-09T15:12:25.873Z","metadata":{"hashes":{"sha256":"328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516","sha1":"35904f482d37f5ce6034d6042bae207418e450f4","md5":"c47b884de127ddc62e44689af4927bcf","sha512":"abf066832ea9dd2c1bf6bdead0b1f70ff307a69f0294ba1839f7864fc4dc8dc67b60158b941b8133cab433d901465fa244ed893da8bc600a5878b0499b8083fb","ssdeep":"6144:6b3Fchyc8esNmYn9X+zrZYunwctA50uB5xgGLj5tuhmfuniGZ+:6b1chbQp5IlwCEJ55++","ssdeep_chunks":["6144:6b3Fchy","6144:b3Fchyc","6144:3Fchyc8","6144:Fchyc8e","6144:chyc8es","6144:hyc8esN","6144:yc8esNm","6144:c8esNmY","6144:8esNmYn","6144:esNmYn9","6144:sNmYn9X","6144:NmYn9X+","6144:mYn9X+z","6144:Yn9X+zr","6144:n9X+zrZ","6144:9X+zrZY","6144:X+zrZYu","6144:+zrZYun","6144:zrZYunw","6144:rZYunwc","6144:ZYunwct","6144:YunwctA","6144:unwctA5","6144:nwctA50","6144:wctA50u","6144:ctA50uB","6144:tA50uB5","6144:A50uB5x","6144:50uB5xg","6144:0uB5xgG","6144:uB5xgGL","6144:B5xgGLj","6144:5xgGLj5","6144:xgGLj5t","6144:gGLj5tu","6144:GLj5tuh","6144:Lj5tuhm","6144:j5tuhmf","6144:5tuhmfu","6144:tuhmfun","6144:uhmfuni","6144:hmfuniG","6144:mfuniGZ","6144:funiGZ+","12288:6b3Fchy","12288:b3Fchyc","12288:3Fchyc8","12288:Fchyc8e","12288:chyc8es","12288:hyc8esN","12288:yc8esNm","12288:c8esNmY","12288:8esNmYn","12288:esNmYn9","12288:sNmYn9X","12288:NmYn9X+","12288:mYn9X+z","12288:Yn9X+zr","12288:n9X+zrZ","12288:9X+zrZY","12288:X+zrZYu","12288:+zrZYun","12288:zrZYunw","12288:rZYunwc","12288:ZYunwct","12288:YunwctA","12288:unwctA5","12288:nwctA50","12288:wctA50u","12288:ctA50uB","12288:tA50uB5","12288:A50uB5x","12288:50uB5xg","12288:0uB5xgG","12288:uB5xgGL","12288:B5xgGLj","12288:5xgGLj5","12288:xgGLj5t","12288:gGLj5tu","12288:GLj5tuh","12288:Lj5tuhm","12288:j5tuhmf","12288:5tuhmfu","12288:tuhmfun","12288:uhmfuni","12288:hmfuniG","12288:mfuniGZ","12288:funiGZ+","6144:6b1chbQ","6144:b1chbQp","6144:1chbQp5","6144:chbQp5I","6144:hbQp5Il","6144:bQp5Ilw","6144:Qp5IlwC","6144:p5IlwCE","6144:5IlwCEJ","6144:IlwCEJ5","6144:lwCEJ55","6144:wCEJ55+","6144:CEJ55++"],"imphash":"ab54c2d97e8c18c3a14c415b6f725943"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":356320,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1519058801000,"last_seen":1659960378000,"last_multi_scan":1659960378000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["babylon","konni"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":32,"suspicious_count":11,"malicious_count":7,"total":50},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.BypassUAC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Exploit]/Win32.BypassUAC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.cnzki","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Generik.ISDNVFL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Exploit.Win32.BypassUAC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0054e8161 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Exploit.Win32.BypassUAC.hpo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FPFW!C47B884DE127","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Drop.ewtsjd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Heur.AdvML.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Exploit.BypassUAC.Win32.1195","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Exploit.BypassUAC","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"WINWORD.EXE\" at 00018119-00001740-00000033-69450488\n \"wusa.exe\" at 00018369-00002576-00000033-68219769","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00017353-00000984-40068-33-010A2D20\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00017353-00000984-40068-12-010A17F5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00017353-00000984-40068-356-010A5C10","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00017353-00000984-40068-212-010A6D8D","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00017353-00000984-40068-88-010A9FE7","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"WINWORD.EXE\" queries volume information of \"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC\" at 00018119-00001740-00000046-79624240\n \"WINWORD.EXE\" queries volume information of \"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC\" at 00018119-00001740-00000046-79624636","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wusa.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"2.16.106.107:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Task\\DDE Attack\\MaoCheng\\Release\\Dropper.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc\"\n \"\" created file \"%TEMP%\\setup.cab\"\n \"WINWORD.EXE\" created file \"%TEMP%\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc\"\n \"WINWORD.EXE\" created file \"%TEMP%\\~$X_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-53749\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-53749\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Local\\x64_10MU_ACB10_S-1-5-5-0-53749\"\n \"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-53749\"\n \"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~$X_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\RICHED20.DLL\" at E46B0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"WINWORD.EXE\" (UID: 00018119-00001740) was launched with new environment variables: \"MEOW=\"%PROGRAMFILES%\\Microsoft Office\\Office14\\\"\"\n Process \"cmd.exe\" (UID: 00018318-00003376) was launched with missing environment variables: \"MEOW\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c wusa %TEMP%\\setup.cab /quiet /extract:%SystemRoot%\\System32 && del /f /q %TEMP%\\setup.cab && cliconfg.exe\" on 2018-3-5.01:39:00.062\n \"/c del /f /q C:\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe\" on 2018-3-5.01:57:00.468","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"OfficeTooltip\"\n \"WINWORD.EXE\" searching for class \"MsoCommandBarPopup\"\n \"WINWORD.EXE\" searching for class \"REListbox20W\"\n \"WINWORD.EXE\" searching for class \"NetUICtrlNotifySink\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WINWORD.EXE\" with commandline \"/n \"%TEMP%\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc\"\" (UID: 00018119-00001740)\n Spawned process \"cmd.exe\" with commandline \"/c wusa %TEMP%\\setup.cab /quiet /extract:%SystemRoot%\\System32 && del /f /q %TEMP%\\setup.cab && cliconfg.exe\" (UID: 00018318-00003376)\n Spawned process \"wusa.exe\" with commandline \"wusa %TEMP%\\setup.cab /quiet /extract:%WINDIR%\\System32\" (UID: 00018369-00002576)\n Spawned process \"cmd.exe\" with commandline \"/c del /f /q C:\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe\" (UID: 00019652-00003708)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Adobe Systems Incorporated\" (SHA1: 0D:47:A4:49:D8:43:B9:98:17:6B:66:58:26:7C:75:45:75:56:1D:18; see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"WINWORD.EXE\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc\" has type \"data\"\n \"~$X_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc\" has type \"data\"\n \"~WRS{714CFD5E-8DD5-4C7F-BB40-01A3015272A6}.tmp\" has type \"FoxPro FPT blocks size 0 next free block index 218103808 1st used item \"\\375\"\"\n \"setupact.log\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"\n \"~$Normal.dotm\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"WINWORD.EXE\" monitors \"\\REGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" (Filter: 15; Subtree: 31871233)\n \"WINWORD.EXE\" monitors \"\\REGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Software\\Microsoft\\Office\\14.0\\Word\\Place MRU\" (Filter: 4; Subtree: 4248118528)\n \"WINWORD.EXE\" monitors \"\\REGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Software\\Microsoft\\Office\\14.0\\Word\\File MRU\" (Filter: 4; Subtree: 4248118528)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\wpdshext.dll\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\en-US\\wpdshext.dll.mui\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\shdocvw.dll\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$25","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"$26","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"WINWORD.EXE\" opened \"%TEMP%\\CVR6F8F.tmp\" with delete access\n \"WINWORD.EXE\" opened \"%TEMP%\\tst7F7E.tmp\" with delete access\n \"WINWORD.EXE\" opened \"%TEMP%\\tst800B.tmp\" with delete access\n \"WINWORD.EXE\" opened \"%TEMP%\\tst8099.tmp\" with delete access\n \"WINWORD.EXE\" opened \"%TEMP%\\tst8107.tmp\" with delete access\n \"WINWORD.EXE\" opened \"%TEMP%\\tst82ED.tmp\" with delete access\n \"WINWORD.EXE\" opened \"%TEMP%\\tst836B.tmp\" with delete access\n \"WINWORD.EXE\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml\" with delete access\n \"wusa.exe\" opened \"%WINDIR%\\SysWOW64\\$dpx$.tmp\" with delete access\n \"wusa.exe\" opened \"C:\\8c195f85b9ee63f42f77690d54\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"WINWORD.EXE\" opened \"\\Device\\KsecDD\"\n \"wusa.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WINWORD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wusa.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Music\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\WINWORD.EXE\", Handle: 588)\n \"\" is creating a new process (Name: \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\", Handle: 640)\n \"\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\cmd.exe\", Handle: 636)\n \"cmd.exe\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\wusa.exe\", Handle: 124)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"\\Device\\MountPointManager\"\n \"WINWORD.EXE\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCloseKey\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n LoadLibraryW\n WriteFile\n GetModuleHandleW\n TerminateProcess\n CreateFileW\n Sleep\n GetTickCount\n CreateFileA\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00017353-00000984)\n Spawned process \"WINWORD.EXE\" with commandline \"/n \"%TEMP%\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc\"\" (UID: 00018119-00001740)\n Spawned process \"cmd.exe\" with commandline \"/c wusa %TEMP%\\setup.cab /quiet /extract:%SystemRoot%\\System32 && del /f /q %TEMP%\\setup.cab && cliconfg.exe\" (UID: 00018318-00003376)\n Spawned process \"wusa.exe\" with commandline \"wusa %TEMP%\\setup.cab /quiet /extract:%WINDIR%\\System32\" (UID: 00018369-00002576)\n Spawned process \"cmd.exe\" with commandline \"/c del /f /q C:\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe\" (UID: 00019652-00003708)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"19/65 Antivirus vendors marked sample as malicious (29% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"19/65 Antivirus vendors marked sample as malicious (29% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\MICROS~2\\Office14\\WINWORD.EXE\" (Handle: 588)\n \"\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\MICROS~2\\Office14\\WINWORD.EXE\" (Handle: 588)\n \"\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\MICROS~2\\Office14\\WINWORD.EXE\" (Handle: 588)\n \"\" wrote 8 bytes to a remote process \"%PROGRAMFILES%\\MICROS~2\\Office14\\WINWORD.EXE\" (Handle: 588)\n \"cmd.exe\" wrote 1500 bytes to a remote process \"%WINDIR%\\SysWOW64\\wusa.exe\" (Handle: 124)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\SysWOW64\\wusa.exe\" (Handle: 124)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\SysWOW64\\wusa.exe\" (Handle: 124)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\SysWOW64\\wusa.exe\" (Handle: 124)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\SysWOW64\\wusa.exe\" (Handle: 124)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"Internal YARA signature matched on process \"OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe\"\n Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"*.youtube-nocookie.com\" (Indicator: \"youtube\")\n \"*.youtube.com\" (Indicator: \"youtube\")\n \"*.youtubeeducation.com\" (Indicator: \"youtube\")\n \"youtube.com\" (Indicator: \"youtube\")\n \"youtubeeducation.com\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"support@xero.com\"","origin":"File/Memory","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":106,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":87,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":5,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["babylon","konni"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5a9c854c7ca3e1555222d089","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Johnnie","contacted_countries":["EU"],"submit_name":"OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516","analysis_start_time":"2018-03-05T01:18:14+00:00","indicators_count":{"informative":31,"suspicious":11,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"5a8afd697ca3e16640465e93","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Johnnie","contacted_countries":["USA"],"submit_name":"328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516","analysis_start_time":"2018-02-21T18:16:19+00:00","indicators_count":{"informative":31,"suspicious":8,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"2.16.106.107","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"address":"172.217.22.78","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}],"processes":[{"pid":984,"ppid":0,"name":"OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe","command_line":"","sha256":"328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516","normalized_path":"C:\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe","uid":"00017353-00000984","icon":"$2a"},{"pid":1740,"ppid":984,"name":"WINWORD.EXE","command_line":"/n \"%TEMP%\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc\"","sha256":"c0a081e6d5e0279be4503f26f0b01bcedeebf1dfb95fcbe4fb935f881d111da0","normalized_path":"%PROGRAMFILES%\\MICROS~2\\Office14\\WINWORD.EXE","parent_uid":"00017353-00000984","uid":"00018119-00001740"},{"pid":3376,"ppid":984,"name":"cmd.exe","command_line":"/c wusa %TEMP%\\setup.cab /quiet /extract:%SystemRoot%\\System32 && del /f /q %TEMP%\\setup.cab && cliconfg.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00017353-00000984","uid":"00018318-00003376"},{"pid":2576,"ppid":3376,"name":"wusa.exe","command_line":"wusa %TEMP%\\setup.cab /quiet /extract:%WINDIR%\\System32","sha256":"cb128faf0430ce1a90412546e90a3b6446c74887d696485cc2c3aaf10714a428","normalized_path":"%WINDIR%\\SysWOW64\\wusa.exe","parent_uid":"00018318-00003376","uid":"00018369-00002576"},{"pid":3708,"ppid":984,"name":"cmd.exe","command_line":"/c del /f /q C:\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00017353-00000984","uid":"00019652-00003708"}],"all_imported_dlls":["winbrand.dll","setupapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","sspicli.dll","apphelp.dll","cryptbase.dll","sechost.dll","MSCONV97.DLL","wow64cpu.dll","version.dll","api-ms-win-downlevel-version-l1-1-0.dll","winhttp.dll","wdscore.dll","wow64.dll","shlwapi.dll","Wldap32.dll","imm32.dll","profapi.dll","iertutil.dll","OART.DLL","rpcss.dll","MSPTLS.DLL","rsaenh.dll","GdiPlus.dll","msi.dll","secur32.dll","wininet.dll","mscoreei.dll","bcrypt.dll","msctf.dll","urlmon.dll","MSOINTL.DLL","RpcRtRemote.dll","oleaut32.dll","sfc_os.dll","mlang.dll","crypt32.dll","WinSCard.dll","msvcr90.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","webio.dll","dbghelp.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","ole32.dll","shell32.dll","advapi32.dll","ieframe.dll","dpx.dll","user32.dll","msvcrt.dll","uxtheme.dll","comctl32.dll","ntmarta.dll","MSO.DLL","WWINTL.DLL","OSPPCEXT.DLL","gdi32.dll","devobj.dll","msimg32.dll","MSGR3EN.DLL","clbcatq.dll","winmm.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","powrprof.dll","msxml6.dll","msxml6r.dll","USP10.DLL","propsys.dll","wpdshext.dll","ntdll.dll","wow64win.dll","kernel32.dll","KernelBase.dll","shdocvw.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rpcrt4.dll","cfgmgr32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","GFX.DLL","MSORES.DLL","mscoree.dll","mscorwks.dll","lpk.dll","sxs.dll","userenv.dll","WWLIB.DLL","wtsapi32.dll","cryptsp.dll","msasn1.dll","msproof7.dll","usp10.dll","msiltcfg.dll","sfc.dll","normaliz.dll","dwmapi.dll","RICHED20.DLL","OSPPC.DLL","oleacc.dll","oleaccrc.dll","msvcp90.dll","psapi.dll","mscss7en.dll","CSS7DATA0009.DLL","MSSP7EN.DLL","NL7MODELS0009.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"~$X_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc","sha256":"f1cc8697310a2b1043ec8fe20a6837e214a41fd0def93631d71fcf9cefe5cb2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"~$Normal.dotm","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"~WRS{714CFD5E-8DD5-4C7F-BB40-01A3015272A6}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"setupact.log","sha256":"3a8f990dfa40cd3ff1f115e95b58e4a41a7f0a086317058ecde508953503ce64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe.bin.doc","sha256":"a9e30993fa531f82e4b08db0b040612127d3c30c55c27f9e370a2f7a5e12847c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"~WRS{A2AAF6D8-4C9B-46FF-9C7D-E64C47182132}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"~$8b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe.bin.doc","sha256":"ec7231627cb083cfd0a55d60bc0e0cd4766f55832b276b9674323a02e403d3e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"ExcludeDictionaryEN0409.lex","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]}],"files_written":[{"path":"C:\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\SysWOW64\\wpdshext.dll","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wpdshext.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\SysWOW64\\wusa.exe","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wusa.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\wusa.lock","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\SysWOW64","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\Logs\\DPX\\setupact.log","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\Logs\\DPX\\setuperr.log","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\Logs\\DPX\\setuplog.cfg","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%TEMP%\\setup.cab","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{714CFD5E-8DD5-4C7F-BB40-01A3015272A6}.tmp","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%TEMP%\\~$X_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%TEMP%\\OTX_328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.doc","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%WINDIR%\\System32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRD0000.doc","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRD0002.doc","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{6E09AD38-69E8-4711-BE8E-28B4DEB0D164}.tmp","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"C:\\328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe.bin.exe","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\wusa.exe","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\en-US\\wusa.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{A2AAF6D8-4C9B-46FF-9C7D-E64C47182132}.tmp","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%TEMP%\\~$8b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe.bin.doc","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%TEMP%\\328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516.exe.bin.doc","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{38C246EF-89E5-4D05-B642-31ECD37B38D9}.tmp","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004109F100A0C00100000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004109F100C0400100000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004109F10090400100000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004109F100A0C00000000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004109F100C0400000000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004109F10090400000000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WUSA\\WUSACOMMANDLINE\\WUSACOMMANDLINE","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-53749","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-53749","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-53749","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-53749","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"},{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5a9c854c7ca3e1555222d089"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-59802","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-59802","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-59802","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-59802","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a8afd697ca3e16640465e93"}]}]}},"report_ids":{"sandbox_job_ids":["5a9c854c7ca3e1555222d089","5a8afd697ca3e16640465e93"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Exploit.BypassUAC Sample 328b48cd133b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 328b48cd133b…. Malware family: Exploit.BypassUAC. Threat score 100/100. 13/29 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516"}],["$","meta","4",{"property":"og:title","content":"Malicious Exploit.BypassUAC Sample 328b48cd133b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 328b48cd133b…. Malware family: Exploit.BypassUAC. Threat score 100/100. 13/29 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/328b48cd133b4c241e6cd9adf30fabf28f3539cb69f1ef35df263b69f7ff1516"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Exploit.BypassUAC Sample 328b48cd133b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 328b48cd133b…. Malware family: Exploit.BypassUAC. Threat score 100/100. 13/29 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]