Warning! | There might be a problem with the requested link

24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious BZC.YAX.Nioc.1 Sample 65777672f94c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 65777672f94c…. Malware family: BZC.YAX.Nioc.1. Threat score 100/100. 15/26 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/65777672f94cfec5c3198c043cef9621b86a51a8f836a6b098d60e6d99a5abe0","keywords":["Malicious","BZC.YAX.Nioc.1","malware analysis","sandbox report","threat intelligence","65777672f94cfec5c3198c043cef9621b86a51a8f836a6b098d60e6d99a5abe0"],"about":{"@type":"SoftwareApplication","name":"Password.txt.lnk","applicationCategory":["lnk"],"identifier":"65777672f94cfec5c3198c043cef9621b86a51a8f836a6b098d60e6d99a5abe0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"BZC.YAX.Nioc.1","antivirusDetections":{"malicious":15,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7ae,"mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "")26:T855,"mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")27:T563,"mshta.exe" touched "HTML Document" (Path: "HKCU\WOW6432NODE\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\INPROCSERVER32") "mshta.exe" touched "Microsoft HTA Document 6.0" (Path: "HKCU\WOW6432NODE\CLSID\{3050F5C8-98B5-11CF-BB82-00AA00BDCE0B}") "mshta.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\WOW6432NODE\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}") "mshta.exe" touched "Browser Application State" (Path: "HKCR\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}") "mshta.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\WOW6432NODE\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "mshta.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "mshta.exe" touched "JScript Language" (Path: "HKCU\WOW6432NODE\CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}\TREATAS") "mshta.exe" touched "Microsoft Url History Service" (Path: "HKCU\WOW6432NODE\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "mshta.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\TREATAS") "mshta.exe" touched "NetworkListManager" (Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "mshta.exe" touched "Network List Manager" (Path: "HKCU\WOW6432NODE\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS")28:Ta78,"mshta.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 5389824) "mshta.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 5389824) "mshta.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 1375488) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 34661121) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 34661121) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 34667777) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 34667777)29:T425,"mshta.exe" touched file "C:\Windows\SysWOW64\en-US\mshta.exe.mui" "mshta.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "mshta.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "mshta.exe" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "mshta.exe" touched file "C:\Windows\SysWOW64\oleaccrc.dll" "mshta.exe" touched file "C:\Windows\SysWOW64\en-US\mshtml.dll.mui" "mshta.exe" touched file "C:\Windows\SysWOW64\en-US\wshtcpip.dll.mui" "mshta.exe" touched file "C:\Windows\SysWOW64\en-US\wship6.dll.mui" "mshta.exe" touched file "C:\Windows\SysWOW64\wshqos.dll" "mshta.exe" touched file "C:\Windows\SysWOW64\en-US\wshqos.dll.mui"2a:T53e,Heuristic match: "bit.ly" Heuristic match: "bitly.com" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" Pattern match: "http://www.facebook.com/2008/fbml" Pattern match: "https://www.stopbadware.org/" Pattern match: "https://www.antiphishing.org/" Pattern match: "http://bit.ly/2EcDxYA" Pattern match: "https://bitly.com/" Pattern match: "www.google-analytics.com/analytics.js','ga" Pattern match: "https://bitly.com/a/warning?hash=2EcDxYA&url=http%3A%2F%2Ftokenhub.mefound.com%3A8080%2Fcontent.php%3FbKoXOTXmVnTSHElfwRpsGeJlHMCaUr17jUdR6UVEDhjjCbGyXlF%2BP2zMdhvDAk2RpTJ3Lq27Ql8mBh1vLoB2IA%3D%3D" Pattern match: "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX" Pattern match: "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEA1kd7OezZYbS8QeY" Pattern match: "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQ" Pattern match: "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA1iDcyCHWi" Pattern match: "https://bit.ly/2EcDxYA"2b:T8c6,"mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS")2c:Ta37,"mshta.exe" wrote bytes "b4360200" to virtual address "0x74A84D68" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "6012e971" to virtual address "0x76C3E324" (part of module "WININET.DLL") "mshta.exe" wrote bytes "7d07227781ed2077ae861f77c6e01e77effd21772d16207760142277478d1f77a8e21e7760891f7700000000ad37b5748b2db574b641b57400000000" to virtual address "0x71C81000" (part of module "WSHTCPIP.DLL") "mshta.exe" wrote bytes "d83aa874" to virtual address "0x74A901E0" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "b436a874" to virtual address "0x74A90200" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "75dcca76273eca7651c1c876ee9cc8769498c8760fb3ce761099c8769097c87600000000f5162076ead72176d9172076698720760f7722760c112076a934207620142076f8112076ff10207600000000" to virtual address "0x700AE000" (part of module "MSLS31.DLL") "mshta.exe" wrote bytes "c0df1e771cf91d77ccf81d770d641f7700000000c011207600000000fc3e207600000000e0132076000000009457437625e01e77c6e01e7700000000bc6a427600000000cf3120760000000093194376000000002c32207600000000" to virtual address "0x766C1000" (part of module "NSI.DLL") "mshta.exe" wrote bytes "b4360200" to virtual address "0x74A84EA4" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "71115b017a3b5a01ab8b02007f950200fc8c0200729602006cc805001ecd57017d265701" to virtual address "0x75C907E4" (part of module "USER32.DLL") "mshta.exe" wrote bytes "b436a874" to virtual address "0x74A901E4" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "b84013e971ffe0" to virtual address "0x74A83AD8" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "d83a0200" to virtual address "0x74A84E38" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "d83a0200" to virtual address "0x74A84D78" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "d83aa874" to virtual address "0x74A90258" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "b436a874" to virtual address "0x74A90278" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "b436a874" to virtual address "0x74A9025C" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "d83aa874" to virtual address "0x74A901FC" (part of module "SSPICLI.DLL") "mshta.exe" wrote bytes "68130000" to virtual address "0x74B51680" (part of module "WS2_32.DLL") "mshta.exe" wrote bytes "0efc217781ed2077ae861f77c6e01e77effd21772d162077c0fc1d77da8f287760142277478d1f77a8e21e7760891f7700000000ad37b5748b2db574b641b57400000000" to virtual address "0x71D61000" (part of module "WSHIP6.DLL") "mshta.exe" wrote bytes "b8c015e971ffe0" to virtual address "0x74A836B4" (part of module "SSPICLI.DLL")2d:Td67,Found malicious artifacts related to "67.199.248.10": ... URL: https://bit.ly/2VTlZtx (AV positives: 2/71 scanned on 05/27/2019 16:46:15) URL: https://bit.ly/2uj2dvn (AV positives: 2/70 scanned on 05/27/2019 15:37:12) URL: http://bit.ly/ (AV positives: 1/70 scanned on 05/27/2019 13:38:26) URL: https://bit.ly/2uUiGKg (AV positives: 2/66 scanned on 05/27/2019 13:01:21) URL: https://bit.ly/2TIN1qt (AV positives: 5/71 scanned on 05/27/2019 12:11:18) File SHA256: 9b8f234a14258406adcd022b946fcb833fadf57a37a6c96682b1a8467cbef23f (AV positives: 23/55 scanned on 05/27/2019 07:15:33) File SHA256: fd4040375dfac0c1a582dcf984d07fa0c5106e34771e61f35d79a96e152f94b5 (AV positives: 21/72 scanned on 05/27/2019 00:56:37) File SHA256: eb2f5dbb680d9534ac5687d5aeb3a65de1e94c88ca440cffd7cbe16ed79e7cfa (AV positives: 7/56 scanned on 05/27/2019 00:15:50) File SHA256: 8608fc7b8a9ad3b418dfe4cff094611353f111e6a1f50d9e2625bb434fffeebf (AV positives: 34/71 scanned on 05/27/2019 14:39:58) File SHA256: 72acdef0188d7ca013864ad85324eb9fb01e4b1fa180ddd96f75427d2986d99c (AV positives: 28/73 scanned on 05/27/2019 13:24:13) File SHA256: 8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5 (Date: 05/21/2019 17:12:27) File SHA256: 33426a18f32c0fc9b9b44a595177b7844ededdf227507ae19366f546d5420e0c (Date: 05/21/2019 09:12:55) File SHA256: 5312b3b23639e0b7e67c615438794e3520ecf76a0796c784a47661fe095fedfd (Date: 05/20/2019 08:44:52) File SHA256: dc0e03ace1a0d7cbf211913c6e481e74704bcfdd31ba3b724e1bb8d8249f42d9 (Date: 04/27/2019 12:14:14) File SHA256: 8d610a306f6502237a7b8d69deba315ef217c4fb086792f3242dfbc68068bdb4 (Date: 04/27/2019 10:03:29) Found malicious artifacts related to "67.199.248.14": ... URL: https://bitly.com/a/warning?hash=2K5LSnM&url=https%3A%2F%2Fe-reference1.com%2Fext%2F (AV positives: 1/66 scanned on 05/27/2019 14:35:48) URL: https://bitly.com/a/warning?hash=2qYwC4&url=http%3A%2F%2Fwww.alideas.com%2F (AV positives: 1/66 scanned on 05/27/2019 12:16:33) URL: https://bitly.com/2H4wuau (AV positives: 5/66 scanned on 05/27/2019 10:36:59) URL: http://bitly.com/SJzgAl (AV positives: 1/70 scanned on 05/27/2019 02:05:23) URL: https://bitly.com/1kud3qG (AV positives: 2/70 scanned on 05/27/2019 02:05:15) File SHA256: 6204aa2eea7f9829be6285a1d7828e3b015435ff632cfce8e8eb41cfcaab3b8b (AV positives: 35/74 scanned on 05/27/2019 05:20:05) File SHA256: e531b1eacff47a252bb1dd116599cbcf15f5f7ad7dc66185cf6a1d438c1b11f8 (AV positives: 44/73 scanned on 05/26/2019 23:45:15) File SHA256: b0e9d3e5ef12582e133a964bbd6d9cf84511504dd8110e3ee5c43a2a0dccc413 (AV positives: 11/72 scanned on 05/26/2019 00:00:20) File SHA256: 2f57acc0d4917c9c76cc772c789c92a87f7be6300b5b3d02368a34d452a3a9ef (AV positives: 25/72 scanned on 05/26/2019 01:22:15) File SHA256: 8a3dca64ad8d4321d42ec870d8a519fe02b53075fbd840ab1793f08f10999c27 (AV positives: 39/73 scanned on 05/25/2019 10:16:34) File SHA256: f79d2a8b024931328e8c16cb7e74768b2be4b31cb589d645def07113618965bf (Date: 04/10/2019 10:52:25) File SHA256: 2a8fb09c696dffcdbaaee03b8de29d39ccde55d33973f41d118989d9883966d7 (Date: 04/10/2019 10:50:12) File SHA256: c0f4c74a631f4cce3cd0d3da8744f0ebf8cd11ee5759dbf72c6d626d723f8b7c (Date: 04/03/2019 21:40:19) File SHA256: cb5760877a43e6fccd3961cdb4aaef158f046cd2d245fba58747575e34a719f8 (Date: 03/27/2019 15:21:21) File SHA256: 58eae26460bdcd278053d27fcd82bab8d19265a1fc18e92042bbbeeff430b7ff (Date: 03/18/2019 03:17:53)2e:Td67,Found malicious artifacts related to "67.199.248.10": ... URL: https://bit.ly/2VTlZtx (AV positives: 2/71 scanned on 05/27/2019 16:46:15) URL: https://bit.ly/2uj2dvn (AV positives: 2/70 scanned on 05/27/2019 15:37:12) URL: http://bit.ly/ (AV positives: 1/70 scanned on 05/27/2019 13:38:26) URL: https://bit.ly/2uUiGKg (AV positives: 2/66 scanned on 05/27/2019 13:01:21) URL: https://bit.ly/2TIN1qt (AV positives: 5/71 scanned on 05/27/2019 12:11:18) File SHA256: 9b8f234a14258406adcd022b946fcb833fadf57a37a6c96682b1a8467cbef23f (AV positives: 23/55 scanned on 05/27/2019 07:15:33) File SHA256: fd4040375dfac0c1a582dcf984d07fa0c5106e34771e61f35d79a96e152f94b5 (AV positives: 21/72 scanned on 05/27/2019 00:56:37) File SHA256: eb2f5dbb680d9534ac5687d5aeb3a65de1e94c88ca440cffd7cbe16ed79e7cfa (AV positives: 7/56 scanned on 05/27/2019 00:15:50) File SHA256: 8608fc7b8a9ad3b418dfe4cff094611353f111e6a1f50d9e2625bb434fffeebf (AV positives: 34/71 scanned on 05/27/2019 14:39:58) File SHA256: 72acdef0188d7ca013864ad85324eb9fb01e4b1fa180ddd96f75427d2986d99c (AV positives: 28/73 scanned on 05/27/2019 13:24:13) File SHA256: 8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5 (Date: 05/21/2019 17:12:27) File SHA256: 33426a18f32c0fc9b9b44a595177b7844ededdf227507ae19366f546d5420e0c (Date: 05/21/2019 09:12:55) File SHA256: 5312b3b23639e0b7e67c615438794e3520ecf76a0796c784a47661fe095fedfd (Date: 05/20/2019 08:44:52) File SHA256: dc0e03ace1a0d7cbf211913c6e481e74704bcfdd31ba3b724e1bb8d8249f42d9 (Date: 04/27/2019 12:14:14) File SHA256: 8d610a306f6502237a7b8d69deba315ef217c4fb086792f3242dfbc68068bdb4 (Date: 04/27/2019 10:03:29) Found malicious artifacts related to "67.199.248.14": ... URL: https://bitly.com/a/warning?hash=2K5LSnM&url=https%3A%2F%2Fe-reference1.com%2Fext%2F (AV positives: 1/66 scanned on 05/27/2019 14:35:48) URL: https://bitly.com/a/warning?hash=2qYwC4&url=http%3A%2F%2Fwww.alideas.com%2F (AV positives: 1/66 scanned on 05/27/2019 12:16:33) URL: https://bitly.com/2H4wuau (AV positives: 5/66 scanned on 05/27/2019 10:36:59) URL: http://bitly.com/SJzgAl (AV positives: 1/70 scanned on 05/27/2019 02:05:23) URL: https://bitly.com/1kud3qG (AV positives: 2/70 scanned on 05/27/2019 02:05:15) File SHA256: 6204aa2eea7f9829be6285a1d7828e3b015435ff632cfce8e8eb41cfcaab3b8b (AV positives: 35/74 scanned on 05/27/2019 05:20:05) File SHA256: e531b1eacff47a252bb1dd116599cbcf15f5f7ad7dc66185cf6a1d438c1b11f8 (AV positives: 44/73 scanned on 05/26/2019 23:45:15) File SHA256: b0e9d3e5ef12582e133a964bbd6d9cf84511504dd8110e3ee5c43a2a0dccc413 (AV positives: 11/72 scanned on 05/26/2019 00:00:20) File SHA256: 2f57acc0d4917c9c76cc772c789c92a87f7be6300b5b3d02368a34d452a3a9ef (AV positives: 25/72 scanned on 05/26/2019 01:22:15) File SHA256: 8a3dca64ad8d4321d42ec870d8a519fe02b53075fbd840ab1793f08f10999c27 (AV positives: 39/73 scanned on 05/25/2019 10:16:34) File SHA256: f79d2a8b024931328e8c16cb7e74768b2be4b31cb589d645def07113618965bf (Date: 04/10/2019 10:52:25) File SHA256: 2a8fb09c696dffcdbaaee03b8de29d39ccde55d33973f41d118989d9883966d7 (Date: 04/10/2019 10:50:12) File SHA256: c0f4c74a631f4cce3cd0d3da8744f0ebf8cd11ee5759dbf72c6d626d723f8b7c (Date: 04/03/2019 21:40:19) File SHA256: cb5760877a43e6fccd3961cdb4aaef158f046cd2d245fba58747575e34a719f8 (Date: 03/27/2019 15:21:21) File SHA256: 58eae26460bdcd278053d27fcd82bab8d19265a1fc18e92042bbbeeff430b7ff (Date: 03/18/2019 03:17:53)2f:Tc90,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAJMklEQVR42tWXeVDU5xnHadIZ/8jRJtNE0zTGXNNJZjpp/SOn1DRjm2tMbRRNhGhtOqljvGKCxhuTeKBUbhAPBGFBLrlUTrlhF1hgWRZYWK4FloXlEFhgF5D59NnFJNhpapJ2OtPfzHd+/H7we5/P832f93lfXFz+n67r1uuo1PXkV5RS3VPE/zR4WWsOtQYt/hEhpGalc1pxjixlBpcLM0nLzaZIU0JGdQZF+qtkmbP++3BBhWryiovxDgvmrCKazw4fITz2Iod8jnEhLpqDRz9HER9LWMQ5Ll1JISE9megUBemlqaSUJlCgv0Z+e/IPA1uTXEjTwAjVGi3JOQVEJqURcSmds4mpBJyPIigyGu+QEMIUCo4FBhIeF4+PPEfGXSTgVCh+IcGcORfEts/cOfml6/eHCKuox3FNi2zT0wxZx+geHKLR1EehTk9yYRlnU67ifSGOE5Gx7A85h09UHMciYvFXxOEdHo3v+fOcSUxh9/a3WO3q8t0hVsZk0D8+gdU2Rf+EnUH7JNft01yfukH/5A36Jmfoss/QbLVTaRklu6OPWK2Bs+V1HM8qZn9SBh8FhbMnJhX/Ai1bP1jG2pe/B4Ci1oDtxgzG61Y6h63Ou6F/mIa+IXS9g2hFVT0DlHf3U9zZx9W2HpIMJqL13Zyp7ySgtp3DagNHK/RczFOxbf0ruLve8d0AtmeoGLZP0TM2jtY8G8xRC+0C0jo0SqP8rJF3pZ295LSYSNcbSapvI7KmmdCKRvyU9XiX1rG7oIb4hg5KymvY6OGKx5If3R7ALT6e9CYjQ7ZJjMNjNFquo+7pp6yrz6nKbgsVXRaKO3op6OghRzK/bOgmscFItLaNULUenzIdXxbVsjenkiJDJ5kFqu8O8GV+NfrBUdTmAbRid504UNM7RImxj5xWkzNggbFXbLeQ295Dmr6TuLo2IqqbOC3BA8vrOS7Z75dxvLIr6BwcITEzn41rX8TD9TYAy6VgUps6KTP1k9dhJq/dLFlbxIEBVDLXDoBksTRO10q8KKmhXdRBTF0r52tbCK1qwre8AW9xYG9uJenaZroGhzl/6Qqb3J9n3e0A9l5TSzWbSW3uIk1sTZbs0iRAZku32G2WhmLmiqGLi/XtRGpbOauRqq9u5oy6iWDJ/GSpFu/iWj4vrGFfZhl13X109g8SEnOJLR4vsP63P/52APf4a0RoWoiWwS/o2okWxYjSmrpIkiJLFJDUxg6SRTES/IzYHSRBHQV3UuSrqueESscRpY5PslRcqtELgIUaQzsBFxLY6vHSvwc4WFhNiGTjV9lIcFUjgWLn6So9juUYJZlGiqLE5lhdGwqZ83CBDZK/PSEBj0jWXxRUcyi/ymn9gUwl5a1dzmVb1diMb0QM29e5sn7ptwCsS7zGwRItu4s1eDksLNZySJ79JaML2hYJZuCMLLEQCRgo3dGReZBk7FdWJ5ZrOCTLzVF0uwVgS4aS+OpGms0WqjrNZKvUnJSOuOnd51jvOgdg05aP+fRTzx+kXUd9nJXuXVLLYQH2EoA9kvlnsuz2ZZRSqu8QB7pp7R8ip1QlAFH8ZfkzuC+Z04gcA1mlx5ulrbaOTTE0KbLfKkf7dbwftH+j8alpJ4RXnppDeVUckMLdJ8H35arZfKWUWDk39Ejl10rP6JACTMktwC8iGo8/PIHHS3feCtAnu4zWYqN+wMaeyDLuWubDgrcDeHJNGE+9e+prPbQiiKfknWXczrA0KMe3ewVglwTflePIvIKdot1XSyjRt1PR2klRUwfNJjNxl7PwC49gzdKHpQ/8E4BpclrWuLTbPhvdYxOcz2tikVswC/4YwMKVoSxcFSwK4Wdv+fHoigDMYzbpkHYngKfMtWdGGTul4DyzlWy9XEK4shajZYgGk8W5BJuMnYTL1u0dGsyql+5j3SvzbgVok12uSgA05gnqBiboGhln57li7n/Dl0fdQgVmVg8IwBMr/egVyKGJWYAtYrfD8s0S2CHPy0Womo1opD0XiQvF4kCFrpGwi8l84XOENS/fxQfL7sbtmZs7omMQg1ha0ztBjQB0jY4Tp2zjMbdTPLrqm+CLVp/iQSeAPz3WcQbGbU6AvyXn81FyAZtFHyblEVRYRYvsGTqpfHVbN3pTL8oaDYExSew94Clb8Tw2vnk/bkvnALTKfGosdgxWG3mNFn659jSPrAyWwKecwR/5UxAPrwgUB3x5UgC6R74B2JCQy/sJ11gr9w9EqhYjtR0mlIYO8upbqJTnnOIS/KIS+HTHh/x12b1s+eN86QVzAHqloltH7BjFiTc9E3lgeQCPrw512r9guR/z3zghc+/HXb87yuMrfOkeHcMi0+D49j1FButiM3hfDi7++RVScH00dJvRGk1UShG2mXpQpKbx98g4tm1czY53HmKH2y9wWzIHYESW4bioQNfL/OX+PCZ2fxX8jhe8CM+uI0fbhcvzB5j/2jFM1gk5Jdm+Bnj7Qjrvx2VTajBSL9Yrm2TuG1u5pjOg1hsIjY7BRwA2/fl19no8xi7RwgfnADj6wIwoKFnDT173dQI4LL/zRS98Y5WMSQ+wykq5WNDAvUs/FwAbAzeL0D2llPcS8jmeq6JG5rxKsta0d1LR0iH2i+pkWz59jpNyXtzssQS/bb/mk7VP8fP75gCMMXsFXNJw9+99pPhCmLf0MNtPZmKz2Ri12+UgOo5d7mklzYxP32B8crYRfZxd6VwJSsm+ucfiDKpsahPHmilpaKFQpeRwcBhBigTefPU3uL/xBK+9+Mity3D85ok3u9rEvFdPyDQEsEDmvVfqwnFZp2fEhRuMSrFarVZG5FQ8OTnrQGN7l8x5L/VS+Y62W6pvQyUAZXLXtxtJzsjEN1IhO6GCe3/6gDPwPfe43ArgCDM8JUduubtuisLlV3tYvP7U10fxcQGYENlEk3JAlRszMzNOgAP7DhATE8NVCVRTW4dJ2q+hb5By6QU1za1ESgHuOHiIZ5599l/vgI5BJiXIoG02WP/oJO/sjMXluf2s2hNPWX2P8/diAFMS2BH8xs0pc3z71TiLnn6aI8ePs2HDBsJOh6HT6ShTV7HivXdZtGjRt+//jkEc11eDfp9rLsAtB1o3NxYvXszChQtvf/jcsnXHD96O93t5/cf/hP4DhsgeMwP0easAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"65777672f94cfec5c3198c043cef9621b86a51a8f836a6b098d60e6d99a5abe0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790888899735,"unified_at":"2026-10-01T21:08:19.735Z","metadata":{"hashes":{"sha256":"65777672f94cfec5c3198c043cef9621b86a51a8f836a6b098d60e6d99a5abe0","sha1":"bb064d4fac23210fa5125a13c920026de4043664","md5":"7a4a0b0f82e63941713ffd97c127dac8","sha512":"d064e4e4ab167ebdf38aa901699cfbeb0a376a6a5d4672f576912cf2e602045fc27115b75e38c1c8e2971599271df54d1b0419e34244de72d9c78da9e0caf3f8","ssdeep":"24:8t/NbVvEwz8AMPs1ov++G4S6wWwkdyDYiGvORhtC/5MouvmAfX:8TtJ3M0iv+mLyDdxok","ssdeep_chunks":["24:8t/NbVv","24:t/NbVvE","24:/NbVvEw","24:NbVvEwz","24:bVvEwz8","24:VvEwz8A","24:vEwz8AM","24:Ewz8AMP","24:wz8AMPs","24:z8AMPs1","24:8AMPs1o","24:AMPs1ov","24:MPs1ov+","24:Ps1ov++","24:s1ov++G","24:1ov++G4","24:ov++G4S","24:v++G4S6","24:++G4S6w","24:+G4S6wW","24:G4S6wWw","24:4S6wWwk","24:S6wWwkd","24:6wWwkdy","24:wWwkdyD","24:WwkdyDY","24:wkdyDYi","24:kdyDYiG","24:dyDYiGv","24:yDYiGvO","24:DYiGvOR","24:YiGvORh","24:iGvORht","24:GvORhtC","24:vORhtC/","24:ORhtC/5","24:RhtC/5M","24:htC/5Mo","24:tC/5Mou","24:C/5Mouv","24:/5Mouvm","24:5MouvmA","24:MouvmAf","24:ouvmAfX","48:8t/NbVv","48:t/NbVvE","48:/NbVvEw","48:NbVvEwz","48:bVvEwz8","48:VvEwz8A","48:vEwz8AM","48:Ewz8AMP","48:wz8AMPs","48:z8AMPs1","48:8AMPs1o","48:AMPs1ov","48:MPs1ov+","48:Ps1ov++","48:s1ov++G","48:1ov++G4","48:ov++G4S","48:v++G4S6","48:++G4S6w","48:+G4S6wW","48:G4S6wWw","48:4S6wWwk","48:S6wWwkd","48:6wWwkdy","48:wWwkdyD","48:WwkdyDY","48:wkdyDYi","48:kdyDYiG","48:dyDYiGv","48:yDYiGvO","48:DYiGvOR","48:YiGvORh","48:iGvORht","48:GvORhtC","48:vORhtC/","48:ORhtC/5","48:RhtC/5M","48:htC/5Mo","48:tC/5Mou","48:C/5Mouv","48:/5Mouvm","48:5MouvmA","48:MouvmAf","48:ouvmAfX","24:8TtJ3M0","24:TtJ3M0i","24:tJ3M0iv","24:J3M0iv+","24:3M0iv+m","24:M0iv+mL","24:0iv+mLy","24:iv+mLyD","24:v+mLyDd","24:+mLyDdx","24:mLyDdxo","24:LyDdxok"],"imphash":"Unknown"},"file_info":{"file_name":"Password.txt.lnk","file_type":["lnk"],"file_type_id":"file link","file_size":2377,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1558985771000,"last_seen":1648531236000,"last_multi_scan":1648531236000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":29,"suspicious_count":9,"malicious_count":5,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/LNK.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Vigorf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Heur.BZC.YAX.Nioc.1.059399AF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"LNK/Agent.AX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Heur.BZC.YAX.Nioc.1.059399AF (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"LNK/TrojanDownloader.Agent.AHY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/LNK.Agent.at","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.WinLNK.Agent.wi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"LNK/Downloader.bm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"LNK.Trojan.37758","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DownLnk-X","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan Horse","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.F4855E45","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.F4855E45","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"BZC.YAX.Nioc.1","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"mshta.exe\" at 00057945-00003912-00000033-9139468305","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"mshta.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00057945-00003912-44570-16-00BD1B8C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API HeapSetInformation@KERNEL32.DLL at 00057945-00003912-44570-4-00BD11E5","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00057945-00003912-44570-10-00BD1A38","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00057945-00003912-44570-4-00BD11E5\n GetVersionExA@KERNEL32.DLL at 00057945-00003912-44570-5-00BD144D","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\arial.ttf\" at 00057945-00003912-00000046-36605185627\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\arial.ttf\" at 00057945-00003912-00000046-36748288614\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\arialbd.ttf\" at 00057945-00003912-00000046-36767753798\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\arialbd.ttf\" at 00057945-00003912-00000046-36777169490\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\wingding.ttf\" at 00057945-00003912-00000046-36813569378","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"bit.ly\"\n \"bitly.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"67.199.248.10:443\"\n \"67.199.248.14:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"mshta.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"Local\\MSIMGSIZECacheMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"!IECompat!Mutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"mshta.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"35DDEDF268117918D1D277A171D8DF7B_AB0EF89A86E9ABD0DB10008AB08C3B30\" has type \"data\"\n \"EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619\" has type \"data\"\n \"5887976EDAA817EEF5159B09F6FCD000_81811A81B2BB8C37AEF747EA951F2E7D\" has type \"data\"\n \"T9QCCV9H.txt\" has type \"ASCII text\"\n \"2EcDxYA_1_.htm\" has type \"HTML document ASCII text\"\n \"warning_1_.htm\" has type \"HTML document ASCII text with very long lines\"\n \"EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB\" has type \"data\"\n \"bitly_warning_hand_1_.png\" has type \"PNG image data 77 x 78 8-bit colormap non-interlaced\"\n \"urlref_httpsbit.ly2EcDxYA\" has type \"HTML document ASCII text with very long lines\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$28","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"\" (Indicator: \"facebook.com\")\n \"\n\n\nWarning! | There might be a problem with the requested link\nWarning! | There might be a problem with the requested link\" (Indicator: \"there might be a problem with the requested link\"; Context: \"https://bit.ly/2EcDxYA\")\n \"

Stop - there might be a problem with the requested link

\" (Indicator: \"there might be a problem with the requested link\"; Context: \"https://bit.ly/2EcDxYA\")","origin":"File/Memory","relevance":10,"id":"string-26","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":95,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":50,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5cec3c2d0388387783615b09","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Probably LNKScript","contacted_countries":["USA"],"submit_name":"Password.txt.lnk","analysis_start_time":"2019-05-27T19:35:32+00:00","indicators_count":{"informative":29,"suspicious":9,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"67.199.248.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"address":"67.199.248.14","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]}],"dns_resolutions":[{"domain":"bit.ly","address":"67.199.248.11","ttl":4,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"domain":"bitly.com","address":"67.199.248.15","ttl":243,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}],"processes":[{"pid":3912,"ppid":0,"name":"mshta.exe","command_line":"https://bit.ly/2EcDxYA","sha256":"949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820","normalized_path":"%WINDIR%\\SysWOW64\\mshta.exe","uid":"00057945-00003912","icon":"$2f"}],"all_imported_dlls":["api-ms-win-downlevel-shlwapi-l1-1-0.dll","ntdll.dll","lpk.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","urlmon.dll","mswsock.dll","msimtf.dll","credssp.dll","wow64.dll","wintrust.dll","cryptnet.dll","winhttp.dll","wow64cpu.dll","oleaut32.dll","dhcpcsvc6.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","Wldap32.dll","nlaapi.dll","cryptbase.dll","iertutil.dll","ws2_32.dll","WSHTCPIP.DLL","bcrypt.dll","cfgmgr32.dll","mshtml.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wshqos.dll","jscript9.dll","wow64win.dll","sechost.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","ieframe.dll","RpcRtRemote.dll","schannel.dll","bcryptprimitives.dll","KernelBase.dll","wininet.dll","msasn1.dll","api-ms-win-downlevel-version-l1-1-0.dll","msvcr100.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","npmproxy.dll","user32.dll","sspicli.dll","userenv.dll","wship6.dll","gpapi.dll","msls31.dll","dwmapi.dll","crypt32.dll","cryptsp.dll","dxgi.dll","WindowsCodecs.dll","devobj.dll","api-ms-win-downlevel-user32-l1-1-0.dll","secur32.dll","d2d1.dll","msvcrt.dll","version.dll","shlwapi.dll","profapi.dll","nsi.dll","uxtheme.dll","shell32.dll","netprofm.dll","kernel32.dll","advapi32.dll","gdi32.dll","rasadhlp.dll","oleaccrc.dll","ncrypt.dll","webio.dll","d3d11.dll","msctf.dll","clbcatq.dll","comctl32.dll","dnsapi.dll","rsaenh.dll","sxs.dll","DWrite.dll","setupapi.dll","rpcrt4.dll","normaliz.dll","imm32.dll","IPHLPAPI.DLL","winnsi.dll","oleacc.dll","d3d10warp.dll","usp10.dll","ole32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","dhcpcsvc.dll","FWPUCLNT.DLL","SensApi.dll","mlang.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_httpsbit.ly2EcDxYA","sha256":"f976fd9d8b23dca5e99af83afe7382e48aaf2c573ef0ce115e9dacd98084ea6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"T9QCCV9H.txt","sha256":"c343e5ced5b5ed305c62a320f4267b2a5df7b600bf20992e1e71cf95c0c4a805","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"5887976EDAA817EEF5159B09F6FCD000_81811A81B2BB8C37AEF747EA951F2E7D","sha256":"f2164b7c48243ab674222b44d158aea992950c1a87755084096618a740a64ae5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619","sha256":"2e49f4b459b631bc2e5121a020f9bfacbef3c6deb9cd790b23ab0fabceb86d6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"35DDEDF268117918D1D277A171D8DF7B_AB0EF89A86E9ABD0DB10008AB08C3B30","sha256":"25692d2d8c28c0249294fcc8210ba884595f9e6e36b20ee45d79e983cf4e5c95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sha256":"01d5374bd54bfca3e930cd8ae59fdad2c61a96c92adec11e8162a64a94a4c1d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"2EcDxYA_1_.htm","sha256":"6ea615c110bf7f147e9a76074e220e0c68874c0f2113d136e3d998bf6249b6bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"warning_1_.htm","sha256":"f976fd9d8b23dca5e99af83afe7382e48aaf2c573ef0ce115e9dacd98084ea6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"bitly_warning_hand_1_.png","sha256":"df60e8e9ab468a0075e0eb85959ba050f6dc1aad58248eeb627b8e21ba22cf58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]}],"files_written":[{"path":"%WINDIR%\\SysWOW64\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\mshtml.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_167DB4E3AB356C5B50FAA8944D554776","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0270780F846F08BEFE0DD8112D932FEF","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5887976EDAA817EEF5159B09F6FCD000_93E2436335028C6F3ED0002F4148ADFE","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6FB1C7BC744B04B7C9588E58823D7FBD","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\9F9C58BCF02CB8A34F017EC53AEBBE1C","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5887976EDAA817EEF5159B09F6FCD000_81811A81B2BB8C37AEF747EA951F2E7D","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5887976EDAA817EEF5159B09F6FCD000_81811A81B2BB8C37AEF747EA951F2E7D","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EKCX8E9R\\2EcDxYA[1].htm","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_A7467B47637944C1E4B4025C763E391F","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_AB0EF89A86E9ABD0DB10008AB08C3B30","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_11564B0BB60FE6C16B65D497BF7744FF","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BEC6224B02D155A396218A2504F3EE0B","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\739F2FF4259CDC6CBE7B90F1A95601EF","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\35DDEDF268117918D1D277A171D8DF7B_AB0EF89A86E9ABD0DB10008AB08C3B30","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EKCX8E9R\\warning[1].htm","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EKCX8E9R\\bitly_warning_hand[1].png","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\Fonts\\wingding.ttf","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5cec3c2d0388387783615b09"}]}]}},"report_ids":{"sandbox_job_ids":["5cec3c2d0388387783615b09"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious BZC.YAX.Nioc.1 Sample 65777672f94c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 65777672f94c…. Malware family: BZC.YAX.Nioc.1. Threat score 100/100. 15/26 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/65777672f94cfec5c3198c043cef9621b86a51a8f836a6b098d60e6d99a5abe0"}],["$","meta","4",{"property":"og:title","content":"Malicious BZC.YAX.Nioc.1 Sample 65777672f94c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 65777672f94c…. Malware family: BZC.YAX.Nioc.1. Threat score 100/100. 15/26 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/65777672f94cfec5c3198c043cef9621b86a51a8f836a6b098d60e6d99a5abe0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious BZC.YAX.Nioc.1 Sample 65777672f94c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 65777672f94c…. Malware family: BZC.YAX.Nioc.1. Threat score 100/100. 15/26 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]