24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CVE-2017-0147 Sample 7b7aa67a3d47… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7b7aa67a3d47…. Malware family: CVE-2017-0147. Threat score 100/100. 24/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7b7aa67a3d47cb39d46ed556b220a7a55e357d2a9759f0c1dcbacc72735aabb1","keywords":["Malicious","CVE-2017-0147","malware analysis","sandbox report","threat intelligence","7b7aa67a3d47cb39d46ed556b220a7a55e357d2a9759f0c1dcbacc72735aabb1"],"about":{"@type":"SoftwareApplication","name":"16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab_2.exe","applicationCategory":["peexe","executable"],"identifier":"7b7aa67a3d47cb39d46ed556b220a7a55e357d2a9759f0c1dcbacc72735aabb1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CVE-2017-0147","antivirusDetections":{"malicious":24,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4c3,"\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!crhrkus!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!crhrkus!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!crhrkus!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\Local\c:!users!crhrkus!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "RasPbFile" "Local\!IETld!Mutex" "Local\ZonesLockedCacheCounterMutex" "Local\ZonesCacheCounterMutex" "Local\WininetConnectionMutex" "Local\c:!users!crhrkus!appdata!roaming!microsoft!windows!cookies!"26:T89b,TCP traffic to 18.19.86.230 on port 51483 TCP traffic to 171.62.227.72 on port 51495 TCP traffic to 134.167.8.132 on port 51512 TCP traffic to 191.1.57.237 on port 51513 TCP traffic to 121.142.176.176 on port 51520 TCP traffic to 125.168.54.78 on port 51521 TCP traffic to 184.239.113.246 on port 51528 TCP traffic to 161.119.64.16 on port 51529 TCP traffic to 113.214.132.233 on port 51534 TCP traffic to 46.66.243.109 on port 51542 TCP traffic to 214.132.44.27 on port 51543 TCP traffic to 105.30.43.212 on port 51546 TCP traffic to 39.193.116.135 on port 51551 TCP traffic to 176.101.0.113 on port 51552 TCP traffic to 180.160.245.40 on port 51554 TCP traffic to 9.98.142.65 on port 51557 TCP traffic to 193.152.50.138 on port 51561 TCP traffic to 82.5.242.100 on port 51563 TCP traffic to 53.51.146.59 on port 51568 TCP traffic to 53.26.141.110 on port 51573 TCP traffic to 57.64.140.51 on port 51576 TCP traffic to 184.96.220.241 on port 51577 TCP traffic to 135.187.247.204 on port 51579 TCP traffic to 9.218.196.71 on port 51582 TCP traffic to 111.245.146.36 on port 51583 TCP traffic to 202.115.47.95 on port 51587 TCP traffic to 43.187.22.79 on port 51588 TCP traffic to 156.72.196.196 on port 51590 TCP traffic to 96.17.217.250 on port 51593 TCP traffic to 194.164.188.88 on port 51597 TCP traffic to 2.239.14.246 on port 51605 TCP traffic to 197.38.44.78 on port 51614 TCP traffic to 160.13.82.111 on port 51620 TCP traffic to 205.121.208.220 on port 51623 TCP traffic to 88.183.87.123 on port 51625 TCP traffic to 4.127.53.38 on port 51629 TCP traffic to 195.67.172.174 on port 51630 TCP traffic to 182.233.70.19 on port 51631 TCP traffic to 180.93.117.106 on port 51635 TCP traffic to 16.125.200.180 on port 51639 TCP traffic to 7.32.200.22 on port 51641 TCP traffic to 103.230.248.142 on port 51644 TCP traffic to 219.44.101.225 on port 51645 TCP traffic to 60.21.108.102 on port 51646 TCP traffic to 37.38.227.119 on port 51647 TCP traffic to 100.41.95.177 on port 51650 TCP traffic to 168.7.78.83 on port 51652 TCP traffic to 68.94.69.146 on port 51656 TCP traffic to 31.47.103.116 on port 51657 TCP traffic to 93.167.35.214 on port 5165827:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7b7aa67a3d47cb39d46ed556b220a7a55e357d2a9759f0c1dcbacc72735aabb1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791145556808,"unified_at":"2026-10-04T20:25:56.808Z","metadata":{"hashes":{"sha256":"7b7aa67a3d47cb39d46ed556b220a7a55e357d2a9759f0c1dcbacc72735aabb1","sha1":"72683d26823d734bfd9ab8f7cec96132549d18d2","md5":"c2559b51cfd37bdbd5fdb978061c6c16","sha512":"40b418946ad39adcd29976038e7486bb97e91c5d9c918ff49f920b031e835bc73c388ec46d4022d4ed151cf9d676e5bd037989d20ec813109f2e1e8b1b1131c4","ssdeep":"12288:GVbLgPluZQhMbaIMu7L5N5b0Xo3LLFzTM8bQr28mw2o:wbLgd+QhfdmngBmc","ssdeep_chunks":["12288:GVbLgPl","12288:VbLgPlu","12288:bLgPluZ","12288:LgPluZQ","12288:gPluZQh","12288:PluZQhM","12288:luZQhMb","12288:uZQhMba","12288:ZQhMbaI","12288:QhMbaIM","12288:hMbaIMu","12288:MbaIMu7","12288:baIMu7L","12288:aIMu7L5","12288:IMu7L5N","12288:Mu7L5N5","12288:u7L5N5b","12288:7L5N5b0","12288:L5N5b0X","12288:5N5b0Xo","12288:N5b0Xo3","12288:5b0Xo3L","12288:b0Xo3LL","12288:0Xo3LLF","12288:Xo3LLFz","12288:o3LLFzT","12288:3LLFzTM","12288:LLFzTM8","12288:LFzTM8b","12288:FzTM8bQ","12288:zTM8bQr","12288:TM8bQr2","12288:M8bQr28","12288:8bQr28m","12288:bQr28mw","12288:Qr28mw2","12288:r28mw2o","24576:GVbLgPl","24576:VbLgPlu","24576:bLgPluZ","24576:LgPluZQ","24576:gPluZQh","24576:PluZQhM","24576:luZQhMb","24576:uZQhMba","24576:ZQhMbaI","24576:QhMbaIM","24576:hMbaIMu","24576:MbaIMu7","24576:baIMu7L","24576:aIMu7L5","24576:IMu7L5N","24576:Mu7L5N5","24576:u7L5N5b","24576:7L5N5b0","24576:L5N5b0X","24576:5N5b0Xo","24576:N5b0Xo3","24576:5b0Xo3L","24576:b0Xo3LL","24576:0Xo3LLF","24576:Xo3LLFz","24576:o3LLFzT","24576:3LLFzTM","24576:LLFzTM8","24576:LFzTM8b","24576:FzTM8bQ","24576:zTM8bQr","24576:TM8bQr2","24576:M8bQr28","24576:8bQr28m","24576:bQr28mw","24576:Qr28mw2","24576:r28mw2o","12288:wbLgd+Q","12288:bLgd+Qh","12288:Lgd+Qhf","12288:gd+Qhfd","12288:d+Qhfdm","12288:+Qhfdmn","12288:Qhfdmng","12288:hfdmngB","12288:fdmngBm","12288:dmngBmc"],"imphash":"39db2bb807c01e6b8fadd4c1f9fc06ed"},"file_info":{"file_name":"16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab_2.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3723264,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286895000,"last_seen":1690075870000,"last_multi_scan":1690075870000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware","wanacrypt0r","wannacry","wcry"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":7,"suspicious_count":15,"malicious_count":8,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wanna.toNz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.WannaCryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Scatter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Ransom.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.WannaCryptor.H","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Wanna-9769986-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.WannaCry.jet","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.WannaCryptor.H (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Exploit.CVE-2017-0147.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDropper/Agent.mh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Exploit ( 0050d7a31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Wanna.m","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-WannaCry!C2559B51CFD3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wanna.eovgam","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Wanna-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.WannaCry.Zen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"WORM_WCRY.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"WORM_WCRY.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/WannaCrypt.E.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.WannaCry.K","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Wanna","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.WannaCry.Win32.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"CVE-2017-0147","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"18.19.86.230:51483\"\n \"171.62.227.72:51495\"\n \"134.167.8.132:51512\"\n \"191.1.57.237:51513\"\n \"121.142.176.176:51520\"\n \"125.168.54.78:51521\"\n \"184.239.113.246:51528\"\n \"161.119.64.16:51529\"\n \"113.214.132.233:51534\"\n \"46.66.243.109:51542\"\n \"214.132.44.27:51543\"\n \"105.30.43.212:51546\"\n \"39.193.116.135:51551\"\n \"176.101.0.113:51552\"\n \"180.160.245.40:51554\"\n \"9.98.142.65:51557\"\n \"193.152.50.138:51561\"\n \"82.5.242.100:51563\"\n \"53.51.146.59:51568\"\n \"53.26.141.110:51573\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$25","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"tasksche.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\"\n \"\" touched file \"%WINDIR%\\tasksche.exe\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab_2.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceA@ADVAPI32.DLL at 00052343-00003212-42027-4-00408090","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00052343-00003212-42027-7-00407CE0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"rasman\" service\n \"\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"tasksche.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"\\\\192.168.56.20\\IPC$\"\n Heuristic match: \"\\\\172.16.99.5\\IPC$\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions: .sqlitedb\n .der\n .key\n .csr\n .pem\n .ott\n .stw\n .3ds\n .3dm\n .ots\n .stc\n .slk\n .odp\n .sxd\n .uop\n .otg\n .mml\n .lay6\n .sqlite3\n .accdb\n .db\n .odb\n .myd\n .ibd\n .ldf\n .cpp\n .asm\n .cmd\n .vb\n .dip\n .sch\n .asp\n .java\n .class\n .mp3\n .swf\n .wmv\n .vob\n .avi\n .mp4\n .mkv\n .flv\n .mid\n .m4u\n .ai\n .nef\n .cgm\n .gif\n .bmp\n .jpeg\n .rar\n .gz\n .tar\n .tbk\n .PAQ\n .aes\n .vmx\n .sldm\n .sti\n .602\n .pdf\n .wks\n .rtf\n .txt\n .edb","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%WINDIR%\\tasksche.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateServiceA\n StartServiceA\n StartServiceCtrlDispatcherA\n GetModuleFileNameA\n GetStartupInfoA\n GetFileSize\n LockResource\n GetProcAddress\n GetModuleHandleA\n GetModuleHandleW\n Sleep\n CreateFileA\n GetTickCount\n FindResourceA\n InternetOpenUrlA\n InternetCloseHandle\n InternetOpenA\n recv (Ordinal #16)\n connect (Ordinal #4)\n socket (Ordinal #23)\n send (Ordinal #19)\n closesocket (Ordinal #3)\n WSAStartup (Ordinal #115)","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"47/61 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"47/61 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"49/84 Antivirus vendors marked dropped file \"tasksche.exe\" as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 58% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"malicious","category":"Installation/Persistance","name":"Creates a system file in windows directory","description":"\"\" created file \"%WINDIR%\\tasksche.exe\"","origin":"API Call","relevance":7,"id":"api-5","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 60 (or more) hosts in at least 25 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"$26","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"WannaCry_Ransomware\" classified file \"16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab_2.exe.bin\" as \"ransomware,wcry,wannacry,wanacrypt0r\" based on indicators: \"icacls . /grant Everyone:F /T /C /Q,tasksche.exe,Global\\MsWinZonesCacheCounterMutexA,WNcry@2ol7,cmd.exe /c \"%s\"\" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":53,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":16,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":154,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware","wanacrypt0r","wannacry","wcry"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59198796aac2ed7a057ea7cc","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.WannaCryptor","contacted_countries":["ARG","AUS","AUT","BEL","BRA","CAN","CHL","CHN","COL","CZE","DEU","DNK","EGY","ESP","FRA","GBR","HUN","IDN","IND","ITA","JPN","KOR","KWT","MAR","MUS","NGA","NLD","NOR","RUS","SGP","SVN","SWE","TWN","UKR","USA","VNM","ZAF","ZZZ"],"submit_name":"16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab_2.exe","analysis_start_time":"2017-05-15T12:49:57+00:00","indicators_count":{"informative":7,"suspicious":17,"malicious":9},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"18.19.86.230","port":51483,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"171.62.227.72","port":51495,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"134.167.8.132","port":51512,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"191.1.57.237","port":51513,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"121.142.176.176","port":51520,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"125.168.54.78","port":51521,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"184.239.113.246","port":51528,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"161.119.64.16","port":51529,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"113.214.132.233","port":51534,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"46.66.243.109","port":51542,"protocol":"TCP","country":"Norway","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"214.132.44.27","port":51543,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"105.30.43.212","port":51546,"protocol":"TCP","country":"Mauritius","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"39.193.116.135","port":51551,"protocol":"TCP","country":"Indonesia","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"176.101.0.113","port":51552,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"180.160.245.40","port":51554,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"9.98.142.65","port":51557,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"193.152.50.138","port":51561,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"82.5.242.100","port":51563,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"53.51.146.59","port":51568,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"53.26.141.110","port":51573,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"57.64.140.51","port":51576,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"184.96.220.241","port":51577,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"135.187.247.204","port":51579,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"9.218.196.71","port":51582,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"111.245.146.36","port":51583,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"202.115.47.95","port":51587,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"43.187.22.79","port":51588,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"156.72.196.196","port":51590,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"96.17.217.250","port":51593,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"194.164.188.88","port":51597,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"2.239.14.246","port":51605,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"197.38.44.78","port":51614,"protocol":"TCP","country":"Egypt","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"160.13.82.111","port":51620,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"205.121.208.220","port":51623,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"88.183.87.123","port":51625,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"4.127.53.38","port":51629,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"195.67.172.174","port":51630,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"182.233.70.19","port":51631,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"180.93.117.106","port":51635,"protocol":"TCP","country":"Viet Nam","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"16.125.200.180","port":51639,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"7.32.200.22","port":51641,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"103.230.248.142","port":51644,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"219.44.101.225","port":51645,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"60.21.108.102","port":51646,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"37.38.227.119","port":51647,"protocol":"TCP","country":"Kuwait","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"100.41.95.177","port":51650,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"168.7.78.83","port":51652,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"68.94.69.146","port":51656,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"31.47.103.116","port":51657,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"93.167.35.214","port":51658,"protocol":"TCP","country":"Denmark","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"146.15.210.100","port":51659,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"114.87.201.251","port":51661,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"202.108.57.181","port":51664,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"199.220.107.6","port":51666,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"210.107.200.61","port":51669,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"36.215.133.95","port":51670,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"4.192.223.119","port":51671,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"134.123.69.70","port":51672,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"116.19.89.166","port":51673,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"166.59.104.87","port":51678,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"160.19.112.189","port":51681,"protocol":"TCP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"72.176.150.39","port":51684,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"94.15.54.84","port":51686,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"76.174.193.104","port":51687,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"183.240.95.187","port":51688,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"56.82.143.46","port":51689,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"205.137.155.242","port":51691,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"83.224.208.185","port":51692,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"144.71.136.60","port":51695,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"212.235.200.76","port":51698,"protocol":"TCP","country":"Slovenia","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"74.229.220.162","port":51700,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"49.69.220.203","port":51701,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"120.119.81.163","port":51702,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"85.188.120.63","port":51703,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"26.225.192.69","port":51705,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"100.56.73.197","port":51706,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"54.194.205.122","port":51718,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"158.237.251.105","port":51726,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"63.36.114.208","port":51733,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"55.156.89.206","port":51735,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"211.139.227.2","port":51736,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"211.186.19.181","port":51737,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"93.41.153.229","port":51739,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"147.152.192.245","port":51740,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"24.72.239.17","port":51741,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"103.142.196.81","port":51744,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"11.162.158.79","port":51745,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"76.229.193.108","port":51748,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"104.3.239.105","port":51753,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"80.243.160.192","port":51760,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"159.118.186.13","port":51766,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"84.195.137.67","port":51769,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"190.114.58.105","port":51775,"protocol":"TCP","country":"Chile","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"37.247.80.238","port":51776,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"98.213.195.176","port":51777,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"181.21.12.185","port":51780,"protocol":"TCP","country":"Argentina","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"130.192.40.254","port":51781,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"29.225.154.25","port":51783,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"68.145.229.25","port":51786,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"4.169.86.46","port":51787,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"177.145.156.88","port":51788,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"27.171.148.44","port":51790,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"223.70.157.184","port":51791,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"44.178.172.84","port":51792,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"122.194.251.25","port":51793,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"159.250.156.57","port":51796,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"209.52.52.125","port":51798,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"106.159.7.128","port":51799,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"77.218.239.91","port":51801,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"174.60.241.237","port":51803,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"121.183.19.94","port":51804,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"81.39.152.173","port":51806,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"19.67.114.233","port":51807,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"60.75.101.128","port":51808,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"59.107.60.120","port":51809,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"186.30.189.108","port":51810,"protocol":"TCP","country":"Colombia","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"79.221.12.79","port":51813,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"22.28.132.121","port":51815,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"196.71.56.113","port":51816,"protocol":"TCP","country":"Morocco","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"191.251.234.73","port":51819,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"150.14.12.147","port":51820,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"207.181.250.101","port":51822,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"77.163.116.77","port":51823,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"146.58.249.156","port":51825,"protocol":"TCP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"86.72.235.154","port":51827,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"78.92.137.122","port":51828,"protocol":"TCP","country":"Hungary","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"43.85.125.110","port":51829,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"84.105.241.183","port":51830,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"193.200.208.163","port":51832,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"100.155.140.43","port":51835,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"97.150.171.187","port":51836,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"31.122.30.77","port":51837,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"40.160.56.51","port":51840,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"6.214.200.190","port":51842,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"93.189.79.64","port":51843,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"192.41.189.172","port":51844,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"44.101.164.108","port":51845,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"88.111.209.24","port":51846,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"217.8.149.89","port":51848,"protocol":"TCP","country":"Norway","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"96.240.60.191","port":51849,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"197.210.225.246","port":51852,"protocol":"TCP","country":"Nigeria","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"17.97.15.88","port":51853,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"89.169.241.146","port":51854,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"141.247.198.91","port":51855,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"158.48.0.75","port":51859,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"102.192.154.53","port":51860,"protocol":"TCP","country":"Indonesia","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"45.58.233.83","port":51861,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"182.142.236.43","port":51862,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"60.173.74.24","port":51863,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"65.158.30.130","port":51864,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"92.117.157.119","port":51865,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"40.18.35.36","port":51869,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"59.26.105.91","port":51870,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"address":"61.229.68.227","port":51871,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}],"processes":[{"pid":3212,"ppid":0,"name":"16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab_2.exe","command_line":"","sha256":"7b7aa67a3d47cb39d46ed556b220a7a55e357d2a9759f0c1dcbacc72735aabb1","normalized_path":"C:\\16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab_2.exe","uid":"00052343-00003212","icon":"$27"}],"all_imported_dlls":["rpcss.dll","clbcatq.dll","kernel32.dll","wininet.dll","crypt32.dll","rtutils.dll","SensApi.dll","rasadhlp.dll","uxtheme.dll","msxml3r.dll","advapi32.dll","IPHLPAPI.DLL","urlmon.dll","ole32.dll","msxml3.dll","WSHTCPIP.DLL","apphelp.dll","sechost.dll","rpcrt4.dll","msvcp60.dll","user32.dll","lpk.dll","usp10.dll","imm32.dll","sspicli.dll","KernelBase.dll","gdi32.dll","oleaut32.dll","iertutil.dll","profapi.dll","rasman.dll","nlaapi.dll","mswsock.dll","ntdll.dll","msvcrt.dll","msasn1.dll","msctf.dll","cryptbase.dll","nsi.dll","comctl32.dll","shell32.dll","ntmarta.dll","NapiNSP.dll","wship6.dll","winnsi.dll","pnrpnsp.dll","winrnr.dll","ws2_32.dll","shlwapi.dll","Wldap32.dll","dnsapi.dll","rasapi32.dll","version.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"tasksche.exe","sha256":"0bb221bf62d875cca625778324fe5bd6907640f6998d21f3106a0447aabc1e3c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"path":"%WINDIR%\\tasksche.exe","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crhrkus!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crhrkus!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crhrkus!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crhrkus!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\c:!users!crhrkus!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\c:!users!crhrkus!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\c:!users!crhrkus!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\c:!users!crhrkus!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59198796aac2ed7a057ea7cc"}]}]}},"report_ids":{"sandbox_job_ids":["59198796aac2ed7a057ea7cc"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious CVE-2017-0147 Sample 7b7aa67a3d47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7b7aa67a3d47…. Malware family: CVE-2017-0147. Threat score 100/100. 24/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7b7aa67a3d47cb39d46ed556b220a7a55e357d2a9759f0c1dcbacc72735aabb1"}],["$","meta","4",{"property":"og:title","content":"Malicious CVE-2017-0147 Sample 7b7aa67a3d47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7b7aa67a3d47…. Malware family: CVE-2017-0147. Threat score 100/100. 24/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7b7aa67a3d47cb39d46ed556b220a7a55e357d2a9759f0c1dcbacc72735aabb1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious CVE-2017-0147 Sample 7b7aa67a3d47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7b7aa67a3d47…. Malware family: CVE-2017-0147. Threat score 100/100. 24/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]