24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 414ed95d1496… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 414ed95d1496…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 1/1 AV engines flagged this file. 7 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":1,"total":1},"behavioralIndicators":{"malicious":7,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T430,"GetModuleHandleExW" (Indicator: "GetModuleHandleExW") "SHGetKnownFolderPath" (Indicator: "SHGetKnownFolderPath") "DllGetVersion" (Indicator: "GetVersion") "SleepConditionVariableCS" (Indicator: "Sleep") "WakeAllConditionVariable" (Indicator: "WakeAllConditionVariable") "FlsGetValue" (Indicator: "FlsGetValue") "FlsSetValue" (Indicator: "FlsSetValue") "InitializeCriticalSectionEx" (Indicator: "InitializeCriticalSection") "CorExitProcess" (Indicator: "ExitProcess") "GetActiveWindow" (Indicator: "GetActiveWindow") "GetDateFormatEx" (Indicator: "GetDateFormatEx") "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle") "GetLastActivePopup" (Indicator: "GetLastActivePopup") "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") "GetTimeFormatEx" (Indicator: "GetTimeFormatEx") "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName") "IsValidLocaleName" (Indicator: "IsValidLocale") "LocaleNameToLCID" (Indicator: "LocaleNameToLCID") "MessageBoxA" (Indicator: "MessageBoxA") "MessageBoxW" (Indicator: "MessageBoxW")26:T425,Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Heuristic match: "bluedragon.com" Heuristic match: "raw.githubusercontent.com" Heuristic match: "semiconductboard.com" Heuristic match: "tecnojournals.com"27:T621,".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 1778205952) ".exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1778205953) ".exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 20180992) ".exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder" (Filter: 4; Subtree: 20180992) "Explorer.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 1778205952) "Explorer.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1778205953) "Explorer.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 60769792) "Explorer.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 60770560) "Explorer.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 60771072) "Explorer.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 60771072) "Explorer.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 60770816)28:T4c3,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\414ED95D14964477BEBF86DCED0306714C497CDE14DEDE67B0C1425CE451D3D7.EXE.LOCAL" ".exe" trying to access non-existent file "C:\MSIMG32.DLL" ".exe" trying to access non-existent file "C:\UXTHEME.DLL" ".exe" trying to access non-existent file "C:\OLEDLG.DLL" ".exe" trying to access non-existent file "C:\OLEACC.DLL" ".exe" trying to access non-existent file "C:\WINMM.DLL" ".exe" trying to access non-existent file "C:\WINMMBASE.DLL" ".exe" trying to access non-existent file "C:\OLEACCRC.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\EXPLORER.EXE" ".exe" trying to access non-existent file "C:\Explorer.exe" ".exe" trying to access non-existent file "Explorer.exe" ".exe" trying to access non-existent file "\Device\NamedPipe\44EFFEF2255214FF" "Explorer.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"29:T42f,RegCreateKeyExW RegDeleteValueW RegCloseKey RegOpenKeyExW RegEnumKeyExW RegEnumKeyW RegDeleteKeyW FindFirstFileW GetFileAttributesW FindResourceExW OutputDebugStringA CopyFileW OutputDebugStringW GetModuleFileNameW IsDebuggerPresent GetModuleFileNameA LoadLibraryA LoadLibraryExW CreateThread GetSystemDirectoryW ExitThread TerminateProcess GetModuleHandleExW LoadLibraryW GetVersionExW GetTickCount VirtualProtect GetFileSize GetStartupInfoW DeleteFileW GetTempFileNameW WriteFile GetFileSizeEx FindFirstFileExA FindNextFileW FindNextFileA FindFirstFileExW GetProcAddress CreateFileW GetSystemInfo FindResourceW LockResource GetCommandLineW GetCommandLineA UnhandledExceptionFilter GetModuleHandleA GetModuleHandleW GetFileAttributesExW GetTempPathW Sleep VirtualAlloc ShellExecuteW ShellExecuteExW GetCursorPos SetWindowsHookExW GetUpdateRect GetLastActivePopup GetWindowThreadProcessId SetSecurityDescriptorDacl CreateProcessA WriteProcessMemory VirtualAllocEx CreateFileA FindResourceA CreateFileMoniker2a:Tc70,".exe" wrote bytes "409b4b76c09b4b76" to virtual address "0x750AE1C8" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "00eb4a76f0ea4a76e00f4b76e0ea4a76900f4b7630eb4a76b0eb4a76f0db4a76700e4b7670eb4a76d0014b76" to virtual address "0x750AE208" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "0070fd69" to virtual address "0x76501E98" (part of module "KERNEL32.DLL") ".exe" wrote bytes "3059c16e" to virtual address "0x0064E468" (part of module "414ED95D14964477BEBF86DCED0306714C497CDE14DEDE67B0C1425CE451D3D7.EXE") ".exe" wrote bytes "80754b7650784b76600b4a76f0744b76b0754b7610294a76e0744b7610754b76500b4a7600754b76" to virtual address "0x750AE144" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "50164b76c0854a76" to virtual address "0x750AE184" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "309fdc74f066df74702adb7420a4dc747023db74003bdc741060dc74b05bdc7400b0dc74805bdc74d081dc74d00dda74" to virtual address "0x76C9E018" (part of module "GDI32.DLL") ".exe" wrote bytes "d04fba76f0c2a47690c6ad7600cba476f0f3ac7640ddac7660efac76102da57680a6a47620beab767042ad76a0beab76c0ffa47640bfab76e058ad76" to virtual address "0x776115B0" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "d04c4d76d0154a76a0764a7640184a76" to virtual address "0x750AE190" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "0070fd69" to virtual address "0x76764EEC" (part of module "USER32.DLL") ".exe" wrote bytes "f0764e76e0774e7640764e76f0754e7630784e7610154b76b05e4e7680784e7690774e7690764e76605e4e7640774e76" to virtual address "0x750AE1D4" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "6087b370" to virtual address "0x0064E784" (part of module "414ED95D14964477BEBF86DCED0306714C497CDE14DEDE67B0C1425CE451D3D7.EXE") ".exe" wrote bytes "108ab370" to virtual address "0x0064E8C4" (part of module "414ED95D14964477BEBF86DCED0306714C497CDE14DEDE67B0C1425CE451D3D7.EXE") ".exe" wrote bytes "a0923801b0923801b017010080f00600c0020100b0f0060060b20600e0913801f0913801" to virtual address "0x7675AC94" (part of module "USER32.DLL") ".exe" wrote bytes "608ab370" to virtual address "0x0064E780" (part of module "414ED95D14964477BEBF86DCED0306714C497CDE14DEDE67B0C1425CE451D3D7.EXE") ".exe" wrote bytes "7067c16e" to virtual address "0x0064E38C" (part of module "414ED95D14964477BEBF86DCED0306714C497CDE14DEDE67B0C1425CE451D3D7.EXE") ".exe" wrote bytes "105bc16e" to virtual address "0x0064E40C" (part of module "414ED95D14964477BEBF86DCED0306714C497CDE14DEDE67B0C1425CE451D3D7.EXE") ".exe" wrote bytes "0070fd69" to virtual address "0x750A8AA0" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "305fc16e" to virtual address "0x0064E3C8" (part of module "414ED95D14964477BEBF86DCED0306714C497CDE14DEDE67B0C1425CE451D3D7.EXE") ".exe" wrote bytes "3083b370" to virtual address "0x0064E788" (part of module "414ED95D14964477BEBF86DCED0306714C497CDE14DEDE67B0C1425CE451D3D7.EXE")2b:T59a,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001632.00000000.192679.006D4000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001632.00000000.192679.006D4000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001632.00000000.192679.006D4000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001632.00000000.192679.006D4000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001632.00000000.192679.006D4000.00000004.mdmp")2c:T160d,Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-13265-00518411 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-13265-00518411 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-13714-0053384F Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-13714-0053384F Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-12114-0044F446 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-12114-0044F446 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-13221-00471756 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-13221-00471756 Assembly shows XOR instruction xor eax 00010000h in Stream UID: 65524-12181-004511EA Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-8970-0043C726 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-8970-0043C726 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-13457-004796E2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-13457-004796E2 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-11565-0043A6D7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-11565-0043A6D7 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-13709-0053343F Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-13709-0053343F Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-13231-004721AD Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-13231-004721AD Assembly shows XOR instruction xor edi B8AC78A3h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edi 935B3A87h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor eax 4F821F1Bh in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edi F9CD69B0h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edx BC2EBCD4h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edx 20569312h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edx 071D1D7Eh in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edi B918396Fh in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edi 35710AE1h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor ebx B3FFFBC9h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edx DF8C9FE9h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor ebx 17A4269Fh in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor ebx 9781BCA7h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor ebx 776D06A6h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor esi 7CDE5083h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edi EC5C7FB0h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edi F74C57DDh in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edi 90656676h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor ebx 1D2D9C49h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor ebx E626D69Bh in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edi C9567B89h in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edx 5CE3018Ah in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor edx 06C2D0AAh in Stream UID: 65524-9152-0062F620 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-10353-00419D76 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-10353-00419D76 Assembly shows XOR instruction xor eax dword ptr [ebx+000000B0h] in Stream UID: 65524-10302-004189CF Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-11277-004325D4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-11277-004325D4 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-11525-004384C8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-11525-004384C8 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-13943-0049A826 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-13943-0049A826 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-13932-004991B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-13932-004991B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-11181-0042FA8E Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-13969-0049AEAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-13969-0049AEAC Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-9855-0040AC57 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-9855-0040AC57 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-12551-0045EC8B Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-12551-0045EC8B Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-13020-00470220 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-13020-00470220 Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-11580-0043B17F Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-11580-0043B17F Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-12544-0045E3FF Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-12544-0045E3FF Assembly shows XOR instruction xor eax ebp in Stream UID: 65524-10525-0041EDE7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 65524-10525-0041EDE72d:Tc60,".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Explorer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"Explorer.exe\" - (UID: 00000000-00006068)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"99.83.154.118:443\"\n \"72.52.10.14:443\"\n \"185.199.109.133:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 2188845)","origin":"Binary File","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32\"\n \"WSoftware\\\"\n \"Software\\Classes\\\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\PreviewHandlers\"\n \"SOFTWARE\\\"\n \"Software\\\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6068:168:WilStaging_02\"\n \"Local\\SM0:6068:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6016:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\332SAE-772FE_main\"\n \"332SAE-772FE_main\"\n \"Local\\SM0:6016:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$25","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\" has an writable section named \".rdata\"\n \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\" has an writable section named \".data\"\n \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\" has an writable section named \".tls\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\" file has an entrypoint instructions - \"call0x5dd1d4,jmp0x5dc0c3,cmpecx, dword ptr [0x6d6004],bnd jne0x5dc272,bnd ret,bnd jmp0x5dcd3d,pushebx,pushesi,pushedi,push0,push0xfa0,push0x6e2584,call0x5e4b8d,addesp, 0xc,push0x64f1d8,calldword ptr [0x64e508],movesi, eax,testesi, esi,je0x5dc330,push0x6883f4,pushesi,calldword ptr [0x64e504],push0x688410,pushesi,movebx, eax,calldword ptr [0x64e504],\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Explorer.exe\" (UID: 00000000-00006016) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", __COMPAT_LAYER=\"ElevateCreateProcess WRPMitigation\"\"\n Process \"Explorer.exe\" (UID: 00000000-00006016) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bluedragon.com\"\n \"raw.githubusercontent.com\"\n \"semiconductboard.com\"\n \"tecnojournals.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Explorer.exe\" (UID: 00000000-00006016)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Explorer.exe\" (UID: 00000000-00006016)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: AB:DC:A7:9A:F9:DD:48:A0:EA:70:2A:D4:52:60:B3:C0:30:93:FB:4B; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority 2011, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: F2:52:E7:94:FE:43:8E:35:AC:E6:E5:37:62:C0:A2:34:A2:C5:21:35; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 99.83.154.118 on port 443\"\n \"HTTPS traffic to 72.52.10.14 on port 443\"\n \"HTTPS traffic to 185.199.109.133 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed api string:\"SystemParametersInfoW\" [Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]","origin":"File/Memory","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindFirstFileW\" [Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed api string:\"GetKeyState\" [Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed api string:\"GetSystemMetrics\" [Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Observed api string:\"DllGetClassObject\" [Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to take screen capture of the target machine (API string)","description":"Observed api string:\"CreateCompatibleBitmap\" [Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed api string:\"GetFileSecurityW which can Obtains specified information about the security of a file or directory\"[Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]\n Observed api string:\"SetFileSecurityW which can Sets the security of a file or directory object\"[Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Explorer.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetFileSecurityW\" which can \"Obtains specified information about the security of a file or directory\" [Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]\n Observed import api \"SetFileSecurityW\" which can \"Sets the security of a file or directory object\" [Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]\n Observed import api \"InitializeSecurityDescriptor\" which can \"Initializes a new security descriptor\" [Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]\n Observed import api \"SetSecurityDescriptorDacl\" which can \"Sets information in a discretionary access control list (DACL)\" [Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"Explorer.exe\" at 00000000-00006016-00000036-23251380","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.78036069363","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00006068)\n \"Explorer.exe\" called \"RtlGetVersion\" with parameter / (UID: 00000000-00006016)\n \"Explorer.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00006016)\n \"Explorer.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00006016)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00006068)\n \"Explorer.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00006016)\n \"Explorer.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00006016)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"Explorer.exe\" sleeping for \"00600000\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/70 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"suspicious","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin)","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\" has resource with unusual entropy \"RT_BITMAP:7.99271548025\"\n \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\" has resource with unusual entropy \"RT_BITMAP:7.99959145499\"\n \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\" has resource with unusual entropy \"RT_ICON:7.97177335865\"\n \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\" has resource with unusual entropy \"RT_ICON:7.95901021401\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$27","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 99.83.154.118 on port 443 is sent without HTTP header\n TCP traffic to 72.52.10.14 on port 443 is sent without HTTP header\n TCP traffic to 185.199.109.133 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"\"GetSystemInfo\" (Indicator: \"systeminfo\")\n \"BorderOuterNormal\" (Indicator: \"route\")\n \"BorderOuterActive\" (Indicator: \"route\")\n \"rderOuterActive\" (Indicator: \"route\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$28","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \".exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$29","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessA\" with parameter \"Explorer.exe\" - (UID: 00000000-00006068)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/70 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 4024 bytes to a remote process \"%WINDIR%\\SysWOW64\\explorer.exe\" (Handle: 688)\n \".exe\" wrote 8 bytes to a remote process \"%WINDIR%\\SysWOW64\\explorer.exe\" (Handle: 688)\n \".exe\" wrote 4 bytes to a remote process \"%WINDIR%\\SysWOW64\\explorer.exe\" (Handle: 688)\n \".exe\" wrote 446695 bytes to a remote process \"%WINDIR%\\SysWOW64\\explorer.exe\" (Handle: 688)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63765b004249fd625b2a3271"},{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001632.00000000.192679.006D4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameW@SHLWAPI.dll at 65524-11635-004ABA95","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00001632.00000000.192679.006D4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\\\44EFFEF2255214FF; Source: \"00000000-00002784-00000C51-2021409732\")\n Found string - \\\\.\\pipe\\44EFFEF2255214FF; Source: \"00000000-00001632.00000000.192672.009D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 65524-11299-005DCD15","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6683b036267337c6800f4927"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"