24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T46a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 4659dadbf5b0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4659dadbf5b0…. Malware family: Malware. Threat score 100/100. 22/25 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a"],"about":{"@type":"SoftwareApplication","name":"evtdiag.exe","applicationCategory":["peexe","executable"],"identifier":"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":22,"total":25},"behavioralIndicators":{"malicious":3,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T45b,"DELETE FROM SAAOWNER.TEXT_%s WHERE TEXT_S_UMID = '%s';" "DELETE FROM SAAOWNER.MESG_%s WHERE MESG_S_UMID = '%s';" "SELECT C.TEXT_S_UMID FROM (SELECT A.TEXT_S_UMID, A.TEXT_DATA_BLOCK FROM SAAOWNER.TEXT_%s A, SAAOWNER.MESG_%s B WHERE A.TEXT_S_UMID = B.MESG_S_UMID AND B.MESG_SENDER_SWIFT_ADDRESS LIKE '%%%s%%' AND (A.TEXT_DATA_BLOCK LIKE '%%%d/%d%%' OR A.TEXT_DATA_BLOCK LIKE '%%%d/%.5d%%')) C WHERE ROWNUM = 1;" "SELECT MESG_S_UMID FROM SAAOWNER.MESG_%s WHERE MESG_SENDER_SWIFT_ADDRESS LIKE '%%%s%%' AND MESG_TRN_REF LIKE '%%%s%%';" "UPDATE SAAOWNER.TEXT_%s SET TEXT_DATA_BLOCK = UTL_RAW.CAST_TO_VARCHAR2('%s') WHERE TEXT_S_UMID = '%s';" "UPDATE SAAOWNER.MESG_%s SET MESG_FIN_CCY_AMOUNT = '%s' WHERE MESG_S_UMID = '%s';" "SELECT MESG_FIN_CCY_AMOUNT FROM SAAOWNER.MESG_%s WHERE MESG_S_UMID = '%s';" "SELECT MESG_S_UMID FROM SAAOWNER.MESG_%s WHERE MESG_SENDER_SWIFT_ADDRESS LIKE '%%%s%%' AND MESG_FIN_CCY_AMOUNT LIKE '%%%s%%';" "SELECT * FROM (SELECT JRNL_DISPLAY_TEXT, JRNL_DATE_TIME FROM SAAOWNER.JRNL_%s WHERE JRNL_DISPLAY_TEXT LIKE '%%LT BBHOBDDHA: Log%%' ORDER BY JRNL_DATE_TIME DESC) A WHERE ROWNUM = 1;"26:T4d4,Found API call GetLocalTime@KERNEL32.DLL (Target: "evtdiag.exe"; Stream UID: "00119265-00002304-6184-16-00409230") which is directly followed by "cmp ax, 000007E0h" and "jbe 00409269h". See related instructions: "... +0 sub esp, 10h +3 xor eax, eax +5 lea ecx, dword ptr [esp+00h] +9 mov dword ptr [esp+02h], eax +13 push ecx +14 mov dword ptr [esp+0Ah], eax +18 mov word ptr [esp+04h], 0000h +25 mov dword ptr [esp+0Eh], eax +29 mov word ptr [esp+12h], ax +34 call dword ptr [0040D0F8h] ;GetLocalTime +40 mov ax, word ptr [esp+00h] +45 cmp ax, 000007E0h +49 jbe 00409269h" ... at 00119265-00002304-6184-16-00409230 Found API call GetLocalTime@KERNEL32.DLL (Target: "evtdiag.exe"; Stream UID: "00119265-00002304-16117-16-00409230") which is directly followed by "cmp ax, 000007E0h" and "jbe 00409269h". See related instructions: "... +0 sub esp, 10h +3 xor eax, eax +5 lea ecx, dword ptr [esp+00h] +9 mov dword ptr [esp+02h], eax +13 push ecx +14 mov dword ptr [esp+0Ah], eax +18 mov word ptr [esp+04h], 0000h +25 mov dword ptr [esp+0Eh], eax +29 mov word ptr [esp+12h], ax +34 call dword ptr [0040D0F8h] ;GetLocalTime +40 mov ax, word ptr [esp+00h] +45 cmp ax, 000007E0h +49 jbe 00409269h" ... at 00119265-00002304-16117-16-0040923027:T1bdf,"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004580) "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004580)28:T2237,Found reference to API (Indicator: "GetTokenInformation"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "CloseServiceHandle"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "OpenServiceA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "OpenProcessToken"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "SetServiceStatus"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "DeleteService"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "OpenSCManagerA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "StartServiceCtrlDispatcherA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GetLastError"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "EnterCriticalSection"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "WriteProcessMemory"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "ReadFile"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "Process32First"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "lstrlenA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GetFileAttributesA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GlobalFree"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "WaitForSingleObject"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "CopyFileA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "ExitProcess"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "FlushFileBuffers"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GetModuleFileNameA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "RemoveDirectoryA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GetLocalTime"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "DeleteCriticalSection"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GetCurrentProcess"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GetFileSize"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "OpenProcess"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "CreateDirectoryA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "DeleteFileA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "Module32First"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "Process32Next"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "ReadProcessMemory"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "VirtualProtectEx"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GetTempPathA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GetFileSizeEx"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "CreateThread"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "SetFilePointer"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "FindFirstFileA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "Module32Next"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "WriteFile"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "CloseHandle"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GetTempFileNameA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "FindNextFileA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "LocalFree"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "MoveFileA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "CreateProcessA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "InitializeCriticalSection"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "GlobalAlloc"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "FindClose"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "Sleep"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "IsBadReadPtr"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "CreateFileA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "LocalAlloc"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "LeaveCriticalSection"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "HttpSendRequestA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "InternetQueryDataAvailable"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "HttpOpenRequestA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "InternetReadFile"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "InternetCloseHandle"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "InternetOpenA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "InternetConnectA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "HttpQueryInfoA"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a") Found reference to API (Indicator: "SeDebugPrivilege"; File: "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a")29:Tbbe,"DELETE FROM SAAOWNER.TEXT_%s WHERE TEXT_S_UMID = '%s';" (Source: 4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a, Indicator: "delete from saaowner.text_%s where text_s_umid = '%s';") "DELETE FROM SAAOWNER.MESG_%s WHERE MESG_S_UMID = '%s';" (Source: 4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a, Indicator: "delete from saaowner.mesg_%s where mesg_s_umid = '%s';") "SELECT C.TEXT_S_UMID FROM (SELECT A.TEXT_S_UMID, A.TEXT_DATA_BLOCK FROM SAAOWNER.TEXT_%s A, SAAOWNER.MESG_%s B WHERE A.TEXT_S_UMID = B.MESG_S_UMID AND B.MESG_SENDER_SWIFT_ADDRESS LIKE '%%%s%%' AND (A.TEXT_DATA_BLOCK LIKE '%%%d/%d%%' OR A.TEXT_DATA_BLOCK LIKE '%%%d/%.5d%%')) C WHERE ROWNUM = 1;" (Source: 4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a, Indicator: "select c.text_s_umid from (select a.text_s_umid, a.text_data_block from saaowner.text_%s a, saaowner.mesg_%s b where a.text_s_umid = b.mesg_s_umid and b.mesg_sender_swift_address like '%%%s%%' and (a.text_data_block like '%%%d/%d%%' or a.text_data_block like '%%%d/%.5d%%')) c where rownum = 1;"), "SELECT MESG_S_UMID FROM SAAOWNER.MESG_%s WHERE MESG_SENDER_SWIFT_ADDRESS LIKE '%%%s%%' AND MESG_TRN_REF LIKE '%%%s%%';" (Source: 4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a, Indicator: "select mesg_s_umid from saaowner.mesg_%s where mesg_sender_swift_address like '%%%s%%' and mesg_trn_ref like '%%%s%%';"), "UPDATE SAAOWNER.TEXT_%s SET TEXT_DATA_BLOCK = UTL_RAW.CAST_TO_VARCHAR2('%s') WHERE TEXT_S_UMID = '%s';" (Source: 4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a, Indicator: "update saaowner.text_%s set text_data_block = utl_raw.cast_to_varchar2('%s') where text_s_umid = '%s';"), "UPDATE SAAOWNER.MESG_%s SET MESG_FIN_CCY_AMOUNT = '%s' WHERE MESG_S_UMID = '%s';" (Source: 4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a, Indicator: "update saaowner.mesg_%s set mesg_fin_ccy_amount = '%s' where mesg_s_umid = '%s';"), "SELECT MESG_FIN_CCY_AMOUNT FROM SAAOWNER.MESG_%s WHERE MESG_S_UMID = '%s';" (Source: 4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a, Indicator: "select mesg_fin_ccy_amount from saaowner.mesg_%s where mesg_s_umid = '%s';"), "SELECT MESG_S_UMID FROM SAAOWNER.MESG_%s WHERE MESG_SENDER_SWIFT_ADDRESS LIKE '%%%s%%' AND MESG_FIN_CCY_AMOUNT LIKE '%%%s%%';" (Source: 4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a, Indicator: "select mesg_s_umid from saaowner.mesg_%s where mesg_sender_swift_address like '%%%s%%' and mesg_fin_ccy_amount like '%%%s%%';"), "SELECT * FROM (SELECT JRNL_DISPLAY_TEXT, JRNL_DATE_TIME FROM SAAOWNER.JRNL_%s WHERE JRNL_DISPLAY_TEXT LIKE '%%LT BBHOBDDHA: Log%%' ORDER BY JRNL_DATE_TIME DESC) A WHERE ROWNUM = 1;" (Source: 4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a, Indicator: "select * from (select jrnl_display_text, jrnl_date_time from saaowner.jrnl_%s where jrnl_display_text like '%%lt bbhobddha: log%%' order by jrnl_date_time desc) a where rownum = 1;")2a:T94c,"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")2b:Teb9,"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "4659DADBF5B07C8C3C36AE941F71B631737631BC3FDED2FE2AF250CEBA98959A.EXE"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "")2c:T4ff,"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" trying to touch file "C:\4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" trying to touch file "C:\WINSPOOL.DRV" "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" trying to touch file "C:\Windows\SysWOW64\winspool.drv" "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe" trying to touch file "C:\MSVCP60.DLL"2d:T7d5," \"%s\"\" (Indicator: \"cmd.exe /c\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartServiceCtrlDispatcher\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartService\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 77580000\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 77580000\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 77580000\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" loaded module \"KERNEL32\" at base 74600000\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72e60000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C70000\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 733B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77A20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\" was detected as \"Microsoft Visual C++\" and name: \"Compiler\"\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$29","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x40d248,push\t0x40bfd8,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x20,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,and\tdword ptr [ebp - 4], 0,push\t1,call\tdword ptr [0x40d178],pop\tecx,or\tdword ptr [0x419620], 0xffffffff,or\tdword ptr [0x419624], 0xffffffff,call\tdword ptr [0x40d17c],mov\tecx, dword ptr [0x419618],mov\tdword ptr [eax], ecx,call\tdword ptr [0x40d184],mov\tecx, dword ptr [0x419614],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x40d170],mov\teax, dword ptr [eax],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerA\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" queries basic process information of the \"C:\\4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" (UID: 4580)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" trying to access non-existent file \"C:\\MSVCP60.DLL\"\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" trying to access non-existent file \"C:\\IPHLPAPI.DLL\"\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" trying to access non-existent file \"C:\\WININET.DLL\"\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" trying to access non-existent file \"C:\\BCRYPT.DLL\"\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" trying to access non-existent file \"C:\\WINSPOOL.DRV\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"HttpSendRequestA\" (Indicator: \"HttpSendRequest\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"HttpQueryInfoA\" (Indicator: \"HttpQueryInfo\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"Process32First\" (Indicator: \"Process32First\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"Module32First\" (Indicator: \"Module32First\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"Process32Next\" (Indicator: \"Process32Next\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"Module32Next\" (Indicator: \"Module32Next\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Source: 4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"},{"report_type":"sandbox","report_id":"5bfff19d7ca3e171c07ecf94"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" queried SystemProcessInformation at 00000000-00004580-00000C13-656574478 [PID: 4580]\n \"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a.exe\" queried SystemProcessInformation at 00000000-00004580-00000C13-656583452 [PID: 4580]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a\" has section name .text with entropy \"6.06687572166\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"66d9d844b1c42262cc0e03bf"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp ax, 000007E0h\" and \"jbe 00409269h\" at 00036518-00004004-29629-19-00409230","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5bfff19d7ca3e171c07ecf94"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WmiPrvSE.exe\" (UID: 00036519-00003096)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5bfff19d7ca3e171c07ecf94"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WmiPrvSE.exe\" (UID: 00036519-00003096)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5bfff19d7ca3e171c07ecf94"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"